CISA adds two exploited Check Point flaws to federal fix list

The U.S. Cybersecurity and Infrastructure Security Agency added two Check Point Security Gateway flaws to its list of known exploited vulnerabilities and told federal agencies to apply fixes or mitigations by September 25. Check Point confirmed active exploitation of a VPN flaw that can let an unauthenticated attacker execute code remotely. It also warned that attackers have exploited a separate Management web service flaw since July 23. Check Point says attacks against Spark customers began September 12. It recommends updated software or patches for affected gateways and firewalls. Customers who installed an earlier offline patch package need a newer version for full coverage.