This week’s cyber security bulletin brings critical updates on fast-moving threats, including an actively exploited Check Point 0-day vulnerability, the newly patched Certighost flaw in Active Directory Certificate Services, and a fresh set of HTTP/2 server vulnerabilities. Each of these incidents presents serious risks to organisations relying on affected products, and the urgency for rapid mitigation cannot be overstated.
Check Point 0-Day Authentication Flaw: Active Exploitation in Progress
The most urgent story this week is CVE-2026-16232, a critical authentication bypass flaw targeting Check Point’s widely used SmartConsole, Security Management, and Multi-Domain Management platforms. With a CVSS score of 9.3, this vulnerability is already being exploited in the wild, prompting an emergency bulletin from CISA and immediate response from Check Point.
What Happened?
Announced in July 2026, the flaw enables unauthenticated, remote attackers to obtain application login tokens and gain administrative access to affected Check Point management systems. Attackers bypass standard authentication entirely, potentially giving them full control over firewall policies, VPNs, and other vital security functions.
- Affected Products: Check Point SmartConsole, Security Management, Multi-Domain Management (specific versions not disclosed, but all systems without the latest hotfix are vulnerable)
- Attack Vector: Remote, unauthenticated – only environments with management interfaces exposed to the internet without strict IP restrictions are at immediate risk
- Timeline: Publicly disclosed in July 2026; CISA added the CVE to its Known Exploited Vulnerabilities catalog; Check Point released a Jumbo Hotfix on 22 July 2026
- Exploitation Status: Active exploitation confirmed, with attackers seeking exposed management consoles
Check Point also revealed two related vulnerabilities, CVE-2026-62144 and CVE-2026-62145, which are addressed in the same hotfix bundle. Organisations are urged to restrict access to SmartConsole interfaces to trusted IPs and apply the latest patches without delay.
Certighost AD CS Flaw: Domain Takeover Risk via Certificate Abuse
Another major event is the disclosure of ‘Certighost’, a vulnerability (CVE-2026-54121) in Microsoft’s Active Directory Certificate Services (AD CS). This flaw allows a low-privilege domain user to impersonate a Domain Controller (DC) and potentially seize control of an entire AD domain.
How the Certighost Attack Works
The flaw arises from the certificate enrollment process. The AD CS ‘chase’ lookup trusts an attacker-supplied host (the cdc parameter) without confirming it is a legitimate Domain Controller. Combined with the default ms-DS-MachineAccountQuota setting (which lets any user register new machine accounts), an attacker can register a rogue machine, request a certificate using the DC’s identity, and receive a valid certificate.
- Product Impacted: Microsoft Active Directory Certificate Services (all supported Windows Server versions prior to July 2026 patch)
- Attack Steps: Register rogue machine account, abuse chase fallback in enrollment, obtain DC-signed certificate, perform DCSync to extract krbtgt hash
- Potential Impact: Full domain compromise via Kerberos and replication abuse
- Timeline: Vulnerability disclosed July 2026; patch released in Microsoft’s July updates
- Mitigation: Apply patch immediately. If not possible, disable chase fallback with
EDITF_ENABLECHASECLIENTDC
Microsoft’s patch introduces stricter validation for the chase process. Until patched, disabling the vulnerable fallback is the only effective mitigation for at-risk domains.
HTTP/2 Server Flaws: New Denial-of-Service Vectors Revealed
Researchers have uncovered a class of denial-of-service (DoS) vulnerabilities affecting the HTTP/2 protocol, tracked as CVE-2026-44909, CVE-2026-59173, and CVE-2026-59762. These flaws allow remote attackers to crash web servers by manipulating flow-control parameters and stalling data transmission.
Technical Details and Affected Vendors
Attackers can set the SETTINGS_INITIAL_WINDOW_SIZE parameter to zero or avoid sending WINDOW_UPDATE frames, causing the server to buffer increasingly large responses in memory. This memory amplification can lead to out-of-memory conditions, terminating processes or even crashing the operating system.
- Impacted Vendors: Apache Traffic Server, Citrix, F5 Networks, Meta, Red Hat, SUSE, Yahoo; Cloudflare and AMD confirmed they are not affected
- Exploitability: Unauthenticated, remote – any exposed HTTP/2 endpoints may be at risk
- Mitigations: Enforce strict memory limits on buffered responses, cap concurrent streams per connection, terminate connections with suspicious flow-control behaviour
- Timeline: Disclosed July 2026, vendors releasing patches and mitigations
Exploitation attempts are expected to rise as proof-of-concept code becomes public and vendors continue to roll out updates. Organisations with high-traffic HTTP/2 servers should act quickly to implement workarounds and monitor for abnormal memory use.
Why These Threats Matter
The Check Point 0-day and Certighost flaws both enable attackers to bypass core authentication in critical infrastructure, leading to total system or domain compromise. The new HTTP/2 vulnerabilities threaten service availability for high-traffic web environments. All three issues highlight the increasing pace and sophistication of attacks against core enterprise platforms.
Steps for Affected Organisations
- Apply the relevant patches and hotfixes from Check Point and Microsoft as a top priority.
- Restrict management and certificate services interfaces to trusted IP ranges.
- For HTTP/2 servers, enforce memory and connection limits and monitor for DoS attempts.
- Review vendor advisories for mitigation and monitoring guidance.
Originally reported by cybersecuritynews.com.
