# CERT-FR Flags Check Point RCE Flaws

Published: 2026-11-12 · Severity: severe · Sectors: Technology, Infrastructure
Canonical: https://vorant.io/reports/e0f140ba-01b3-55a6-baad-4c78f64719e4/cert-fr-flags-check-point-rce-flaws
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> CERT-FR advisory warns of multiple vulnerabilities in Check Point Security Gateway, Cluster and Spark firewall products enabling remote code execution.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1501

## What to check

- Applies to: The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-109618 and CVE-2026-109619 as exploited in the wild.

CERT-FR issued an advisory (CERTFR-2026-AVI-1501) detailing multiple vulnerabilities affecting Check Point security products, including Cluster Members, Security Gateway, Security Group members (versions 81.x prior to 81.20 and 82.x prior to 82.20), and Spark Firewalls (versions prior to R81.10.17 Build 996004992 and R82.00.11 Build 998002a823). The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, allow an attacker to achieve arbitrary remote code execution on affected systems.

No details are provided regarding active exploitation in the wild; the advisory is a vulnerability disclosure requiring patching rather than a report of ongoing attacks. Check Point has published a security bulletin (sk1000302, dated November 11, 2026) with remediation guidance. Defenders operating affected Check Point Security Gateway, Cluster, Security Group, or Spark Firewall deployments should prioritize applying the vendor's patches given the severity of remote code execution and the network-perimeter-facing nature of these products.

## Mentioned in this report

- Vulnerabilities: CVE-2026-109618 (KEV), CVE-2026-109619 (KEV)

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1501

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e0f140ba-01b3-55a6-baad-4c78f64719e4/cert-fr-flags-check-point-rce-flaws.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup