CISA Flags Two Critical Check Point Flaws as Actively Exploited, Urges Immediate Patching

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced today that it has added two critical vulnerabilities affecting a range of Check Point Software Technologies products to its Known Exploited Vulnerabilities (KEV) catalog. The agency’s notice makes clear that threat actors are already leveraging these flaws in the wild, prompting a rapid response from both government and private‑sector IT teams.

CISA’s KEV list serves as a curated inventory of security bugs that have been observed in active attacks. By elevating a vulnerability to this list, the agency signals that the risk is immediate and that remediation should be prioritized over routine patch cycles. The inclusion of Check Point’s issues underscores the agency’s broader effort to surface high‑impact threats that could affect critical infrastructure and federal networks.

The two vulnerabilities, described by CISA as “critical,” affect multiple Check Point products used for firewall, intrusion‑prevention, and secure remote access. While the exact technical details have not been fully disclosed, the agency notes that the flaws can enable remote code execution or privilege escalation, allowing an attacker who successfully exploits them to gain unauthorized control of affected systems.

Federal agencies that rely on Check Point solutions are now required to assess their exposure and apply mitigations without delay. The Department of Homeland Security has reminded contractors and other government entities that compliance with CISA directives is mandatory, and failure to remediate could jeopardize mission‑critical operations. Private enterprises, especially those handling sensitive data, face similar pressure to act quickly to avoid potential breaches.

Check Point responded to the alerts by issuing security advisories and releasing patches for the affected products. In its statements, the company urged customers to install the updates promptly and to review any associated configuration changes. The vendor also emphasized its commitment to continuous monitoring and rapid response in the face of emerging threats.

Security professionals are advised to verify that the latest patches are deployed, monitor network traffic for suspicious activity, and consider additional layers of defense such as intrusion‑detection signatures that target the known exploit patterns. CISA has indicated that it will continue to track the situation and may issue further guidance if new evidence of exploitation emerges, reinforcing the ongoing need for vigilant cyber hygiene across both public and private sectors.