Multiple critical remote code execution vulnerabilities in Check Point products CVE-2026-109618 and CVE-2026-109619
Multiple security vulnerabilities have been discovered in various Check Point products including Cluster Members, Security Gateway, Security Group members, and Spark Firewalls. These vulnerabilities allow remote attackers to execute arbitrary code, posing a critical threat to affected systems. Affected versions include Check Point Cluster Members and Security Gateway 81.x and 82.x prior to 81.20 and 82.20 respectively, Security Group members 81.x and 82.x prior to these versions, and Spark Firewalls versions earlier than R81.10.17 Build 996004992 and R82.00.11 Build 998002a823. Users are strongly advised to apply the security updates provided by Check Point as detailed in their security bulletin sk1000302 dated November 11, 2026. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.
Entenda a falha
A vulnerabilidade
Check Point disclosed two flaws, CVE-2026-109618 and CVE-2026-109619, that let a remote attacker execute arbitrary code. The sources do not describe each CVE separately, and they do not say what access, authentication or configuration an attacker needs. Affected: Cluster Members, Security Gateway and Security Group members 81.x before 81.20 and 82.x before 82.20, and Spark Firewalls before R81.10.17 Build 996004992 and before R82.00.11 Build 998002a823. The fixes are in Check Point's bulletin sk1000302 of November 11, 2026.
Como foi descoberta
The articles do not say who found the flaws or how. Check Point published the fixes in security bulletin sk1000302 on November 11, 2026, and the French CERT-FR issued an advisory (CERTFR-2026-AVI-1501) the next day, pointing to the vendor bulletin for patches.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 13:40.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.
Linha do tempo
-
Multiple critical remote code execution vulnerabilities in Check Point products CVE-2026-109618 and CVE-2026-109619
ler a análise desta fonte ocultar
Multiple security vulnerabilities have been discovered in various Check Point products including Cluster Members, Security Gateway, Security Group members, and Spark Firewalls. These vulnerabilities allow remote attackers to execute arbitrary code, posing a critical threat to affected systems. Affected versions include Check Point Cluster Members and Security Gateway 81.x and 82.x prior to 81.20 and 82.20 respectively, Security Group members 81.x and 82.x prior to these versions, and Spark Firewalls versions earlier than R81.10.17 Build 996004992 and R82.00.11 Build 998002a823. Users are strongly advised to apply the security updates provided by Check Point as detailed in their security bulletin sk1000302 dated November 11, 2026. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619.