CERT-FR Flags Check Point RCE Flaws
CERT-FR advisory warns of multiple vulnerabilities in Check Point Security Gateway, Cluster and Spark firewall products enabling remote code execution.
Sourcecert.cyber.gouv.fr — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-109618 and CVE-2026-109619 as exploited in the wild.
CERT-FR issued an advisory (CERTFR-2026-AVI-1501) detailing multiple vulnerabilities affecting Check Point security products, including Cluster Members, Security Gateway, Security Group members (versions 81.x prior to 81.20 and 82.x prior to 82.20), and Spark Firewalls (versions prior to R81.10.17 Build 996004992 and R82.00.11 Build 998002a823). The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow an attacker to achieve arbitrary remote code execution on affected systems.
No details are provided regarding active exploitation in the wild; the advisory is a vulnerability disclosure requiring patching rather than a report of ongoing attacks. Check Point has published a security bulletin (sk1000302, dated November 11, 2026) with remediation guidance. Defenders operating affected Check Point Security Gateway, Cluster, Security Group, or Spark Firewall deployments should prioritize applying the vendor's patches given the severity of remote code execution and the network-perimeter-facing nature of these products.
Mentioned in this report
Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1501
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs