Daily brief · 2026-09-26 · updated 2026-10-12

4 Critical Security Fixes You Need Today

▶

Check Point Security Gateway

Check Point has disclosed active exploitation of a pre-authentication remote code execution vulnerability in its VPN certificate handling. This flaw, tracked as CVE-2026-85102, impacts the Check Point Security Gateway and allows exploitation prior to authentication. The company is actively observing exploitation attempts directed at its Spark customers worldwide.

Why it matters: An unauthenticated attacker could use this vulnerability to achieve arbitrary code execution on the vulnerable gateways.

What to do: Apply Check Point security patches immediately. Prioritize Check Point Spark deployments for remediation.

CVEs: CVE-2026-85102

Linux kernel (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964)

The Cybersecurity and Infrastructure Security Agency has added three actively exploited vulnerabilities in the Linux kernel (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to its Known Exploited Vulnerabilities catalog. This addition falls under Binding Operational Directive 26-04, which triggered a three-day remediation deadline on September 18 that has since passed on September 21. The directive requires patching within three days for one of the vulnerabilities across all assets, and for publicly exposed systems for the other two.

Why it matters: These flaws could allow unauthorized privilege escalation or lead to a complete system compromise on vulnerable Linux systems.

What to do: Apply kernel patches within 3 days for exposed systems and 14 days for internal systems per CISA BOD 26-04 deadlines.

CVEs: CVE-2025-39682, CVE-2026-53266, CVE-2025-39964

Arista VeloCloud Orchestrator and Check Point Security Gateway

The Cybersecurity and Infrastructure Security Agency has added four new vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. These additions require federal agencies and all other organizations to patch the flaws in products including Arista VeloCloud Orchestrator and Check Point Security Gateway. Among these four additions is an improper input validation flaw affecting the Arista VeloCloud Orchestrator.

Why it matters: These vulnerabilities can lead to remote code execution and unauthorized access to enterprise infrastructure.

What to do: Apply patches immediately. Federal agencies must comply within CISA deadline.

CVEs: CVE-2026-93952

Windows 11 File History utility

Microsoft has acknowledged a bug in the Windows 11 File History utility following the installation of update KB5124008. The issue causes false failure reports and false alerts prompting users to reconnect their drive. Microsoft clarified that the prompt is not a drive connectivity issue and that there is nothing wrong with the external drive. However, File History may still fail to create or update backups after installing this update.

Why it matters: Because of this bug, users cannot verify backup success, and the false connectivity alerts cause unnecessary troubleshooting efforts.

What to do: Do not disconnect external drives based on false File History alerts. Await Microsoft repair patch.

Tags: check-point-security-gateway, linux-kernel, arista-velocloud-orchestrator-and-check-point-security-gateway, windows-11-file-history-utility