Attackers exploit the SonicWall SonicOS SSLVPN flaw CVE-2026-19868 in the wild. Update Gen7 and Gen8 firewalls now to patch CVE-2026-107155 and 6 bugs.
CVE-2026-19868 is an authentication bypass vulnerability affecting the SSL VPN service in SonicWall SonicOS.
“An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).” reads the advisory.
The flaw occurs when the system does not properly enforce SAML authentication controls. An attacker who already has valid credentials for an alternative authentication method may exploit this weakness to bypass SAML-based authentication.
The impact is particularly serious when organisations rely on SAML to enforce multi-factor authentication (MFA). Successful exploitation may allow an attacker to access the SSL VPN without completing the expected SAML authentication process, potentially bypassing the additional MFA protection.
In practical terms, the vulnerability could weaken an organisation’s remote access security by allowing users with alternative valid credentials to circumvent its intended authentication controls.
It’s important to highlight that this is not an unauthenticated remote access vulnerability. The attacker needs valid credentials for an alternative authentication method, but may then bypass SAML-enforced security controls.
SonicWall’s PSIRT team is investigating a report of possible exploitation of this flaw. The company strongly recommends that customers install the latest available update as soon as possible to reduce the risk of attacks.
“SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.” reads the advisory.
Learn how governments detect VPN traffic using IP addresses, protocol fingerprints and active probing, and why encryption alone cannot prevent blocking.
Compare WireGuard, OpenVPN and Shadowsocks for speed, privacy, enterprise access and censorship resistance, including VPN tunnels differ from encrypted proxies.
FortiBleed 2.0 investigation, published October 27, revealed 40,573 cleartext secret records in exposed FortiGate configurations, including 37,076 local-user passwords and 1,576 Active Directory LDAP bind records linking firewall access, VPN services, and internal identity systems.
The researchers examined 1,703 configuration-report files containing 101,419 credential and account records associated with 1,689 host identifiers.
The material also includes administrator logins, email-server passwords, and high-availability cluster secrets. These figures reflect records, not unique users, confirmed physical devices, or credentials that still work today.
Despite its name, FortiBleed 2.0 is a follow-up investigation based on recently obtained files, not a newly disclosed vulnerability. Most files are dated February 20, 2026, while 31 are undated, leaving the timing of initial access and configuration theft unconfirmed.
FortiBleed 2.0 Exposes Fortinet VPN and AD Credentials
Compared with the first dataset, researchers identified 924 additional host identifiers and 975 domain labels absent from the earlier collection.
Overview of Hudson Rock’s free FortiBleed lookup portal
However, domain labels can belong to service providers, registration contacts, or account holders. They should not be read as 975 newly compromised companies. The findings expand earlier FortiBleed credential exposure coverage by revealing accounts and services behind perimeter logins.
The associated toolchain extracts firewall configurations, recovers stored secrets, and attempts further access. Its parsing workflow collects local users, administrator entries, LDAP connections, cluster settings, and email credentials.
Some stored FortiOS ENC values can be recovered offline when configurations use the system-default encryption key. Recovery depends on the software version, settings, and available material.
Cavalier Exposes 54 Credential Records Across Two Hosts
Exposed local-user passwords may support VPN access, but account status, access rules, reachability, and multifactor authentication determine whether login succeeds.
Hudson Rock’s analysis identified 7,437 disabled local-user records containing cleartext data. Empty MFA fields do not necessarily indicate missing MFA, as external authentication systems may enforce it.
LDAP bind credentials deserve close attention because they connect FortiGate appliances to directory services. An account with excessive rights could increase the impact of a breach.
Ordinary LDAP query access, however, does not automatically grant domain-administrator privileges. Earlier reporting on FortiGate configuration theft highlights this route toward internal access.
Cavalier’s Breach Data
Fortinet’s response guidance calls for terminating administrator and VPN sessions, resetting credentials, enforcing MFA, updating firmware, and restricting management access.
Security teams should compare current settings with a trusted configuration and examine firewall and domain-controller logs for unexpected activity. The configuration findings also call for reviewing LDAP bind passwords, cluster secrets, and email-server credentials.
Investigators should verify ownership of recurring administrator accounts such as fgtsecure and forticloud-sync before treating them as unauthorized. Account names alone do not establish malicious activity.
An misconfigured Vibetech database exposed 13.7 million records from previous breaches, including AT&T, Casio and FBI data, passwords and bank details.
Ivanti VPN zero-days let attackers gain root access, steal credentials, evade detection, and prepare for wider network compromise.
On October 5, Volexity started investigating suspicious activity at one of its monitoring customers and traced everything back to an Ivanti Connect Secure VPN appliance running version 22.8R2.4, the latest build available at the time. Three chained zero-days gave an unknown attacker unauthenticated root access.
“n the first week of October 2026, Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4) Ivanti Connect Secure (ICS) VPN appliance.” states Volexity. “This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. The RCE and authentication bypass vulnerabilities are tracked under CVE-2026-104935.”
The attacker, tracked as UTA0576, had been inside the device since at least October 3, two days before anyone noticed. Ivanti released a patch for two of the three vulnerabilities on October 13; the privilege escalation fix is still coming in a future release.
The first flaw affects welcome.cgi, the public login page. An attacker sends a request to this page that passes the authentication checks but includes the path to a protected internal script in an HTTP header. The system checks the URL to decide whether to allow the request, but uses the header to decide where to send it. This mismatch allows the attacker to bypass authentication.
The attacker then uploads a Perl script disguised as a ZIP file through another endpoint. The server saves the file, checks whether it is a valid ZIP archive, and schedules it for deletion when the check fails. Before the file is deleted, the attacker sends multiple requests to its predictable location on disk. If a request reaches the file in time, the script executes. Both the authentication bypass and the race-condition flaw that enables remote code execution are tracked under CVE-2026-104935.
The third step escalates from the limited web server user to full root. A privileged background service called dsinvoked runs maintenance tasks as root and looks up which programs to execute in a shared configuration store. UTA0576 patches that store in memory, redirects a legitimate task to the Perl interpreter instead, triggers the task, and gets root execution. Then everything gets silently restored to its original state.
Volexity found that the attack changed code in memory but restored the configuration data, which explains why Ivanti’s Integrity Checker Tool did not detect anything suspicious. The tool checks files stored on disk, but this attack left no permanent changes there.
Each time UTA0576 ran a command, the attackers repeated the entire exploit chain. They received the results through normal HTTPS responses instead of using a persistent backdoor or web shell. They also deleted selected entries from Ivanti debug logs and Linux audit logs covering the attack. Temporary files were removed automatically after use. The attackers hid a packet capture tool under a renamed executable in a directory not shown in normal file listings. They also used eight rotating capture files, allowing older network traffic to be overwritten.
Once inside, UTA0576 went straight for credentials. The attacker deployed a custom Python LDAP tool that authenticated to an internal domain controller using the VPN appliance’s own service account and searched Active Directory specifically for LAPS local administrator passwords, BitLocker recovery keys, and any attributes containing passwords in plaintext. Results were compressed and encoded before being exfiltrated back through the same exploit channel.
The attacker also ran a packet capture tool to harvest cleartext credentials from LDAP traffic already flowing through the device, built a custom Kerberos implementation capable of Kerberoasting attacks, and ran password-spraying campaigns against Active Directory accounts.
“Volexity’s forensic investigation revealed that, immediately after exploiting an ICS VPN appliance, UTA0576 began conducting reconnaissance, stealing credentials, and exfiltrating data. Because the operation was detected and disrupted, the threat actor’s ultimate objectives could not be determined.” Volexity continues. “However, Volexity assesses with high confidence that UTA0576’s actions signaled preparation for lateral movement and a broader compromise of the victim network.”
Volexity believes with medium confidence that UTA0576 uses large language models (LLMs) to develop exploits and carry out post-exploitation activities.
That’s not a certain finding, but it’s the kind of attribution detail that’s starting to appear more regularly in incident reports, and it fits the pattern of a single operator producing work that would previously have required a team.
“Volexity’s forensic investigation revealed that, immediately after exploiting an ICS VPN appliance, UTA0576 began conducting reconnaissance, stealing credentials, and exfiltrating data.” concludes the report. “Because the operation was detected and disrupted, the threat actor’s ultimate objectives could not be determined.”
The attackers’ motives remain unclear, but the targets suggest a possible criminal motive rather than espionage. Apply the patches immediately, and don’t assume your appliance is safe just because the Integrity Checker found no problems.
Content The AhnLab SEcurity intelligence Center (ASEC) observed and classified attacks targeting MS-SQL servers and MySQL servers installed on Windows operating systems via the ASD infrastructure. This report summarizes the damage status, attack status, and the types of malware used in the attacks, based on logs identified in the third quarter of 2026. Purpose and […]
Note The September 2026 Dark Web Breach Incident Trend Report focuses on data breach cases and the sale of initial access credentials posted on the deep web and dark web forums. The report explicitly states that the accuracy of some of its content cannot be fully verified due to the nature of the sources. Major […]
O uso de VPN está crescendo em todo o mundo, com uma média global estável de 20% de crescimento ao ano. Os usuários passaram a valorizar tudo o que uma VPN oferece: ela criptografa sua conexão, protege você contra o rastreamento constante do provedor de Internet (e contra os anúncios direcionados que geralmente vêm com ele), oculta seu endereço IP e sua localização e permite que você continue usando seus serviços pagos favoritos durante viagens. Isso é especialmente importante em grandes eventos públicos, como torneios internacionais de futebol, os Jogos Olímpicos ou shows de artistas populares, quando aumenta consideravelmente a probabilidade de golpistas interceptarem uma conexão Wi-Fi desprotegida.
Dito isto, as VPNs também têm seus próprios inconvenientes. Um dos maiores é que muitos dispositivos inteligentes, incluindo TVs, consoles de videogame, dispositivos de streaming e dispositivos de casa inteligente, não têm suporte a VPN. Além disso, normalmente é preciso configurar a VPN separadamente em cada dispositivo da sua casa. Instalar a VPN diretamente no roteador resolve os dois problemas de uma só vez: protege toda a sua rede doméstica, incluindo os novos dispositivos adicionados. Veja mais de perto quais são os benefícios dessa configuração.
1. Todos os dispositivos recebem proteção de VPN
Ative uma VPN no roteador e todos os dispositivos conectados ao seu Wi-Fi doméstico enviarão automaticamente o tráfego por meio dessa conexão protegida e criptografada. Não é preciso fazer mais nada: conecte seu celular, laptop ou TV ao Wi-Fi e o tráfego já será roteado pela VPN.
Muitos serviços de VPN pagos limitam o número de dispositivos que podem ser usados em uma única assinatura. Mas o roteador conta apenas como um dispositivo nessa lista, mesmo que possa proteger uma dúzia ou mais de dispositivos na sua casa ao mesmo tempo.
Vale observar que a instalação de uma VPN em um roteador normalmente só é possível com serviços de VPN pagos. Os planos gratuitos geralmente não oferecem essa opção ou permitem seu uso de forma muito limitada.
2. Configure uma vez e esqueça
Configurar uma VPN em todos os celulares e computadores da casa pode ficar cansativo rapidamente. E, se os dispositivos da sua casa usam diferentes sistemas operacionais, primeiro é preciso localizar as configurações de VPN em cada um deles, pois Android, Windows, iOS e macOS lidam com isso de maneiras diferentes.
Com a configuração no roteador, você configura a VPN uma vez e ela também cobre automaticamente qualquer novo dispositivo que conectar posteriormente.
3. Proteção até para dispositivos que não têm suporte a VPN
Muitos dispositivos não conseguem executar uma VPN. Isso inclui TVs inteligentes, dispositivos de streaming, consoles de videogame e praticamente todos os dispositivos de casa inteligente disponíveis, de babás eletrônicas a aspiradores de pó robôs. Uma VPN no roteador protege todos eles, sem que você precise alterar separadamente as configurações do aspirador de pó ou da lâmpada inteligente.
4. Não há necessidade de se preocupar em ativar e desativar a VPN
Muitas pessoas querem garantir que nem um único byte de seus dados saia do dispositivo antes que a VPN seja ativada. O problema é que sempre existe um pequeno intervalo entre ligar um computador ou celular e a ativação da VPN e, durante esse intervalo, os dados trafegam pela Internet sem criptografia.
As soluções mais comuns são ativar recursos especiais, como Always On VPN ou um Botão de emergência da VPN, no sistema operacional ou no aplicativo da VPN. Uma opção mais eficaz, porém, é executar a VPN no próprio roteador. Dessa forma, a regra de “nenhum byte sem a VPN” passa a valer automaticamente para todos os dispositivos da sua rede doméstica. Mas, para ter total tranquilidade, ainda é recomendável configurar um botão de emergência também no roteador, para que, se a VPN for desconectada (por exemplo, se o servidor VPN ficar temporariamente indisponível), seus dispositivos percam completamente a conexão com a Internet, em vez de voltarem para uma conexão desprotegida.
5. Trabalhe remotamente com duas VPNs ao mesmo tempo
Outro problema comum é precisar executar dois serviços de VPN simultaneamente. Isso geralmente acontece no trabalho remoto: você precisa de uma VPN corporativa para se conectar à rede da empresa e, ao mesmo tempo, quer usar uma VPN pessoal para todo o resto. Em muitos dispositivos, executar duas conexões VPN simultaneamente para finalidades diferentes é difícil de configurar ou simplesmente não é possível. Ficar alternando constantemente entre as duas também não é conveniente e abre brechas de privacidade e segurança.
Uma VPN no roteador também resolve isso. Basta ativar a VPN corporativa no computador de trabalho, e ela será executada sobre a conexão Wi-Fi, que já está protegida pela sua VPN pessoal no roteador. Na prática, uma VPN fica dentro da outra (VPN corporativa → Wi-Fi → VPN → Internet), mas essa configuração em camadas raramente causa problemas.
6. Contorne aplicativos que bloqueiam VPNs
Alguns aplicativos bancários e de streaming podem detectar quando um aplicativo de VPN está em execução no seu dispositivo e simplesmente se recusar a funcionar. Normalmente, eles não conseguem identificar que tipo de VPN é nem por que você a está usando. Eles simplesmente não aceitam nenhuma conexão VPN ativa. Se a VPN for executada no roteador, em vez de no próprio dispositivo, esse problema desaparece.
7. Proteja convidados na sua rede doméstica
Qualquer dispositivo de amigos ou familiares que se conecte ao seu Wi-Fi também recebe automaticamente a proteção da VPN, sem que seja necessário fazer qualquer configuração no dispositivo deles.
8. Menor carga sobre seus dispositivos
Como o roteador cuida da carga de trabalho de criptografia, seus celulares, tablets e outros dispositivos mais simples podem usar menos poder de processamento e consumir menos bateria do que consumiriam se executassem a VPN diretamente.
9. Gerenciamento simplificado da VPN
Precisa trocar de servidor VPN, alterar protocolos ou ajustar outras configurações? Basta fazer isso uma vez, no roteador. Não é preciso reconfigurar cada dispositivo separadamente.
Precauções e pontos importantes
Apesar de todas as suas vantagens, executar uma VPN no roteador também envolve algumas desvantagens que vale a pena conhecer.
Criptografar o tráfego de uma rede inteira exige um poder de processamento considerável, portanto, em um roteador com capacidade insuficiente, a velocidade da conexão pode acabar limitada.
Alguns roteadores não têm suporte a VPN ou funcionam apenas com protocolos mais antigos e menos seguros, como PPTP.
Se o roteador foi fornecido pelo seu provedor de Internet, talvez você não tenha permissões suficientes para instalar uma VPN nele.
Em qualquer um desses casos, você pode comprar um roteador mais potente com suporte a VPNs e usá-lo no lugar do equipamento fornecido pelo provedor ou junto com ele, configurando sua rede doméstica e sua VPN no seu próprio equipamento.
Nessa configuração, seus dispositivos se conectam da seguinte maneira: dispositivo → Wi-Fi ou Ethernet → VPN pessoal no roteador → Internet. Para computadores que também se conectam a uma VPN corporativa, o caminho parece um pouco diferente: dispositivo → VPN corporativa no dispositivo → Wi-Fi ou Ethernet → VPN pessoal no roteador → Internet.
Se não for possível conectar seu próprio roteador diretamente à rede do provedor porque o modelo não tem a porta adequada (por exemplo, no caso de uma conexão de fibra), você pode usar um cabo Ethernet para conectar a entrada do seu roteador pessoal ao equipamento do provedor. Nesse caso, você pode colocar o roteador fornecido pelo provedor no modo bridge ou simplesmente desativar o Wi-Fi dele para evitar interferências sem fio desnecessárias, já que sua única função agora é conectar-se à rede do provedor e transmitir essa conexão ao seu próprio roteador.
Também vale observar que alguns serviços on-line, como bancos, sites governamentais, lojas on-line e plataformas de streaming, podem restringir ou bloquear totalmente o acesso quando detectam um endereço IP estrangeiro por meio de uma VPN. Para contornar isso, você pode desativar o Wi-Fi do celular e usar os dados móveis ou adotar uma abordagem mais sofisticada para a configuração do roteador, conforme descrito abaixo.
A maioria dos roteadores modernos permite criar mais de uma rede Wi-Fi, geralmente oferecendo pelo menos uma rede doméstica e uma rede para visitantes, cada uma com suas próprias configurações. Você pode usar esse recurso para criar duas redes: uma com a VPN sempre ativada e outra sem VPN. Assim, para serviços que não funcionam bem com VPNs, basta mudar para a rede Wi-Fi não protegida.
Se estiver disposto a dedicar um pouco mais de tempo à configuração, há uma opção ainda mais prática, conhecida como túnel dividido: configurar individualmente determinados serviços ou sites para ignorarem a VPN, enquanto todo o restante continua passando normalmente pela sua conexão VPN segura. Para fazer isso, será necessário especificar os endereços dos sites que devem ignorar a VPN.
Muitos roteadores com recursos avançados também permitem dividir os dispositivos da sua casa em grupos e definir regras de conexão diferentes para cada grupo. Dessa forma, você pode configurar sua TV inteligente para acessar serviços de streaming sem VPN, enquanto seus dispositivos de casa inteligente, computadores e celulares se conectam à Internet exclusivamente pelo canal protegido.
Como configurar uma VPN no roteador
Configurar uma VPN no roteador pode parecer mais complicado do que instalá-la em dispositivos individuais, mas proporciona muito mais praticidade e proteção para toda a sua rede doméstica.
Para isso, você precisará de um roteador com suporte a VPN e de uma assinatura de um serviço de VPN que possa gerar arquivos de configuração para roteadores usando protocolos de VPN modernos. O Kaspersky VPN é compatível com os dois protocolos de VPN mais usados, OpenVPN e WireGuard, para conectar roteadores ao serviço.
Você pode criar um Kaspersky VPN arquivo de configuração para o seu roteador seguindo nosso guia detalhado. Para obter instruções específicas para o modelo do seu roteador, recomendamos pesquisar on-line ou perguntar a um assistente de IA algo como “como configurar uma VPN no {modelo do seu roteador}“.
The FBI and U.S. Secret Service issued a joint cybersecurity advisory warning that operators of “FortiBleed” continue to target internet-facing Fortinet FortiGate firewalls and SSL VPN gateways to steal credentials, maintain unauthorized access, and potentially facilitate ransomware attacks. Published on October 6, 2026, the advisory emphasizes administrator lockouts as an emerging consequence of this campaign. […]
Windows 11 Always On VPN fails to connect after the September 2026 update. Switch to a fixed IKEv2 or SSTP protocol until Microsoft ships a permanent fix.
Japan ‘s Digital Agency disclosed a VPN breach exposing 246,000 government employee records across 23 ministries. Detected June 25, publicly disclosed September 11.
Japan ‘s Digital Agency disclosed that attackers exploited a vulnerability in a VPN device to access its Government Solution Service (GSS), potentially leaking personal information belonging to approximately 246,000 government employees, public officials, and contractors. The breach was detected on June 25 and confirmed as a VPN exploitation on July 9, meaning the public disclosure came 78 days after the initial detection and 63 days after the intrusion method was identified.
“It has come to our attention that, due to unauthorized external access, some files containing personal information handled on the Government Solution Service (GSS), operated by the Digital Agency, may have been leaked to an external party.” reads the advisory. “We have confirmed that the personal information that may have been leaked pertains to employees of various ministries and agencies that use GSS (hereinafter referred to as “GSS user organizations”) and those involved in their work, and does not include personal information of the general public.”
GSS connects 23 Japanese ministries and agencies through shared IT infrastructure. A breach of this platform could potentially affect many government organizations at once.
The attack followed a straightforward path. An outsider exploited a vulnerability in a VPN device that serves the GSS network, accessed the system using a maintenance and operations staff member’s account, and browsed a large number of files on the server. The agency detected the unusual activity on June 25, confirmed the VPN exploitation on July 9, then suspended the maintenance account and cut off external communications from the compromised hardware the same day. A subsequent investigation with external security specialists confirmed that files containing personal information may have been exfiltrated.
“On June 25, 2026, we detected that a large number of files on the server had been accessed using the account of a maintenance and operations staff member, and we began an investigation. On July 9, it was discovered that a third party had exploited a vulnerability in the network connection device (VPN) to infiltrate the system and gain unauthorized access. On the same day, we suspended the maintenance and operations staff member’s account and cut off communication between the compromised equipment and the outside world to prevent further unauthorized access.” continues the report.”As a result of our investigation with the cooperation of an external expert company, we have confirmed that there is a possibility that personal information may have been leaked to an external party.”
The potentially exposed data breaks down to roughly 236,000 names, 231,000 email addresses, 94,000 phone numbers, and approximately 1,000 physical addresses. Of the 246,000 total records, about 189,000 belong to employees of GSS-using organizations and public officials involved in their work, including staff at independent administrative agencies. The remaining 57,000 records relate to businesses and individuals contracted to support those organizations. The data doesn’t include My Number identification numbers, financial institution account numbers, or pension numbers.
The VPN flaw was rated medium severity and wasn’t a zero-day. A patch was already available when attackers exploited it, but the agency hasn’t revealed the VPN product or the flaw.
Japan’s privacy regulator was notified on July 15, six days after the attack was confirmed. The Digital Agency said the delay came from the difficulty of tracing the attack, assessing the affected data, and identifying those involved.
The incident also shows the risk of leaving a known, patchable flaw unaddressed on infrastructure shared by 23 ministries.
No confirmed misuse of the exposed data has been reported. However, the leaked names, email addresses and phone numbers could enable targeted phishing and social engineering, including scams impersonating Japan’s Digital Agency. The agency will contact affected people directly and warns that it will never request passwords or payments by email or phone.
The breach is one in a series of significant cybersecurity incidents affecting Japanese institutions. NISC, Japan’s National Cyber Incident Readiness and Strategy Center, disclosed a breach in 2023 that affected its email system. Japan Aerospace Exploration Agency (JAXA) reported unauthorized access to its systems in 2024. The pattern points to systemic challenges in patching and access management across Japan’s public sector infrastructure rather than isolated failures.
The Digital Agency’s planned remediation includes improved vulnerability management and changes to external connection methods, which are the right responses to the immediate incident. Whether they address the underlying governance question is harder to assess from the public advisory alone.
Two critical Check Point VPN flaws score 9.8 and could enable remote code execution. Patch now and restrict VPN access before exploitation begins.
The Dutch NCSC warns that two critical vulnerabilities in Check Point VPN products, both rated CVSS score of 9.8, could soon be actively exploited. If you use Check Point VPN, you should patch it immediately.
CVE‑2026‑85102 resides in the VPN negotiation process and lets an unauthenticated attacker bypass security checks and run their own code on the gateway. CVE‑2026‑85103 is a heap overflow in the certificate ASN.1 decoder that also leads to remote code execution on Security Gateways and Security Management Servers.
Both vulnerabilities can be triggered by external attackers, and while no public proof‑of‑concept has surfaced yet, the NCSC explicitly rates the likelihood of exploitation and the potential damage as high.
“There are 2 critical vulnerabilities in Check Point VPN products with the attributes CVE-2026-85102 and CVE-2026-85103. These are 2 serious vulnerabilities with a CVSS score of 9.8.” reads the alert. “The NCSC assesses the likelihood of exploitation and potential damage as high and expects that attempts at exploitation will occur soon; therefore, the advice is to install the updates as soon as possible.”
An attacker can take over the system, read or change confidential data, and disrupt operations. In practice, that means your VPN appliance stops being a secure entry point and starts being a beachhead inside your network.
Check Point addressed the flaws on September 9 with the release of the advisories sk1000117 and sk1000118. The affected releases span R81.20, R82, R82.10, R81.10.x and R82.00.x, plus end‑of‑support versions from R80 through R81.10. R82.20 is not affected.
For supported versions, Check Point provides fixes through LivePatch Take 24 or specific Jumbo Hotfix updates, depending on the version you use.
If you use LivePatch with R81.20, R82 or R82.10, your system may already be protected without a reboot. However, you should check your setup to make sure. LivePatch does not cover every version or configuration, so don’t assume you are protected.
The NCSC’s advice is straightforward: install the updates as soon as possible. For organizations using Site‑to‑Site VPN, it also recommends tightening the ruleset: disable implied rules and restrict VPN access to specific, trusted IP addresses instead of leaving it wide open. If you’re not sure whether you’re running a vulnerable version, talk to your IT provider now, not after the first IOC shows up in your logs.
“The NCSC advises installing these updates as soon as possible. For organizations using Site-to-Site VPN, it is recommended to adjust certain VPN rules, such as disabling implied rules and restricting VPN access to specific IP addresses.” concludes the alert. “Contact your IT service provider if you are unsure whether you are using a vulnerable version. If necessary, ask for assistance in implementing the recommended measures.”
This isn’t a “schedule a change window next month” situation. It’s a “verify, patch, restrict, and move on before someone else decides your VPN is their new favorite initial access broker” kind of week.
The AhnLab SEcurity intelligence Center (ASEC) recently identified attack cases that exploited Radmin and UltraVNC. Although the Initial Intrusion method remains unknown, the attackers installed Radmin—a remote control tool—and then installed UltraVNC. The threat actors exploited the remote control tools to gain control of the infected systems and installed Netch and CCProxy to use the […]
Entrar
