Check Point has confirmed that hackers are actively exploiting newly disclosed vulnerabilities in its Security Gateway products, warning customers of a wave of attacks that began on September 12 with intruders hiding their locations behind VPN services and proxy networks.
The flaws affect the VPN certificate-handling functionality and the management web service of Check Point's Security Gateway — the appliances many organisations rely on to guard the boundary between their internal networks and the internet. The company confirmed active exploitation in a security advisory and published indicators that defenders can use to hunt for signs of compromise.
The disclosure has drawn an urgent response from the US Cybersecurity and Infrastructure Security Agency (CISA), which added the flaws to its Known Exploited Vulnerabilities catalogue and ordered federal civilian agencies to apply the available fixes by September 25 — one of the shortest remediation deadlines the agency has issued this year.
What Check Point confirmed
According to the company's alert, the wave of exploitation attempts against its customers began on September 12. The attacks originated from anonymisation infrastructure, including commercial VPN services and proxies, making the intruders' true locations difficult to determine.
One of the flaws had already been exploited as a zero-day since late July, meaning attackers were inside some networks before any patch existed. The Dutch National Cyber Security Centre had warned on September 10 that exploitation was imminent and urged users to apply available security updates — a warning that proved accurate within days.
Check Point has now confirmed the malicious activity and shared details of the malicious certificates observed in the attacks, giving defenders concrete artefacts to search for in their own environments.
CISA's September 25 deadline
CISA's decision to add both flaws to its Known Exploited Vulnerabilities catalogue carries real weight: federal agencies are required to remediate catalogue entries by the assigned deadline, and the September 25 date signals that the agency views the threat as active and serious.
The catalogue serves as a broader signal to the private sector as well. When CISA mandates emergency patching for federal systems, security teams at banks, hospitals, telecom operators and critical infrastructure providers typically treat it as a cue to prioritise the same fixes in their own environments.
What organisations should do
The immediate step is to apply the vendor's patches without delay, particularly on internet-facing appliances. Security teams should also review logs for signs of earlier compromise — especially given that one flaw was exploited before the patch existed — and check for the indicators Check Point has published.
Longer term, the incident reinforces the case for defence in depth: segmenting networks so that a compromised edge device does not mean a compromised enterprise, monitoring VPN and gateway activity for anomalies, and maintaining an asset inventory so that emergency patches can be deployed quickly when the next gateway flaw emerges.
Why it matters for Pakistan
Pakistani banks, telecom operators, government departments and large enterprises widely deploy enterprise VPN gateways and security appliances, including Check Point and similar products. Internet-facing security infrastructure in Pakistan is exposed to the same global scanning and exploitation as anywhere else.
The episode highlights the importance of disciplined patch management and coordination with Pakistan's National CERT. When vendors and agencies like CISA flag active exploitation of edge devices, local security teams should treat the warning as applying to them too — attackers do not distinguish by geography.
