IT Daily Roundup – September 24, 2026
1. Check Point Security Gateway – Actively Exploited Pre-Auth RCE in VPN Module
Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution vulnerability in the VPN certificate-handling functionality of its Security Gateway. Exploitation has been underway since September 12, 2026, via anonymization infrastructure, and affects Security Gateway versions R81.20, R82, R82.10, and Spark firewalls. CISA has added CVE-2026-85102 to its Known Exploited Vulnerabilities catalog – a strong urgency signal for the entire private sector. Patches are available as LivePatch Take 26 and Jumbo Hotfixes for each version; Spark devices must be updated to R82.00.10 Build 2325 or R81.10.17 Build 4968.
Why this matters: Check Point Security Gateway is one of the most widely deployed network security and remote-access VPN solutions in the SME segment. The vulnerability requires no authentication – having the VPN port reachable from the internet (which is the entire point of a VPN device) is sufficient to be at risk. If your IT team or managed service provider operates a Check Point gateway, patching should be today's top priority. If you are unsure what firewall or VPN solution your company uses, this is a good moment to request a network infrastructure audit.
2. cPanel – Critical Vulnerability Allows Any Hosting Account to Execute Code as Root
Security researchers disclosed details of three vulnerabilities in cPanel & WHM, the most widely deployed web hosting control panel. The most critical, CVE-2026-87899, resides in the CalDAV and CardDAV service: any logged-in cPanel account – meaning a regular hosting customer – can exploit this flaw to execute arbitrary code with root privileges and take full control of the entire server, including the websites and data of all other customers on the same machine. A second flaw, CVE-2026-87900, allows database tampering across accounts on the same server, while CVE-2026-68490 exposes contact and calendar data. Patches were released on September 22, 2026, in cPanel & WHM versions 11.134.0.57, 11.136.0.41, and 11.138.0.8; WP Toolkit must be updated to version 6.11.3 or later.
Why this matters: Most SME companies host their website on shared hosting powered by cPanel – and this is precisely the problem: dozens of customers share the same physical server. CVE-2026-87899 means that one compromised or malicious hosting account can gain root access to the entire server and read the data, databases, and email of every other business on that machine. If your company runs its own VPS or dedicated server with cPanel, patching is critical. If you use shared hosting through an external provider, contact them and ask for written confirmation that their servers are running a patched version of cPanel.
3. Sangoma Switchvox – CVSS 9.3 SQL Injection Actively Exploited, Thousands of SME VoIP Systems Still Unpatched
Security researchers have confirmed large-scale active exploitation of CVE-2026-9586 (CVSS 9.3) in Sangoma Switchvox SMB Edition 8.3 – a business VoIP phone system commonly used by small and medium-sized companies. The vulnerability is a critical SQL injection in the /pa endpoint: the application directly concatenates XML input values into PostgreSQL queries without any input sanitization. An unauthenticated attacker can execute arbitrary SQL commands, escalate privileges to admin accounts, steal cookie signing keys, and deploy a reverse shell on the compromised server. The patch (version 8.4.0.2) was released by Sangoma on July 14, 2026, but active exploitation began on August 30 – indicating that thousands of the estimated 4,000 internet-exposed instances have still not been updated.
← All postsWhy this matters: Switchvox is a VoIP solution designed and marketed specifically for the SME segment – which makes it a direct target for attackers who know that companies with limited IT resources tend to delay patching. A compromised Switchvox server is not just a security incident – it is an entry point into the entire corporate network and an archive of all business calls, contacts, and communications. If your company uses Switchvox for business telephony, verifying the version and updating should happen today. If it is managed by an external provider, contact them with a specific question: "Are we running version 8.4.0.2 or later?"