Check Point, Kaspersky, Tanium Patch Product Vulnerabilities

Cybersecurity firms Check Point, Kaspersky, and Tanium have released patches to address several critical vulnerabilities in their security products. These vulnerabilities range from remote code execution to SQL injection, and while some have been actively exploited, vendors are urging immediate patching to prevent potential attacks.

Check Point has informed customers about a critical vulnerability affecting Security Management and Log Server products. The flaw, CVE-2026-91843, can be exploited by an unauthenticated attacker “to remotely execute arbitrary code with root privileges through the login process.” Check Point has shared potential indicators of compromise (IoCs) for this vulnerability, despite noting no evidence of in-the-wild exploitation.

Tanium published five new advisories this week to inform customers about high- and medium-severity vulnerabilities. In Tanium Asset, the company fixed two high-severity SQL injection vulnerabilities that authenticated attackers can exploit to gain read and write access to restricted data, or tamper with SQL queries executed by the service. A vulnerability that can be leveraged for SQL query tampering has also been fixed in Threat Response.

Threat Response has also received patches for two medium-severity vulnerabilities: a server-side request forgery allowing access to restricted data, and an improper access control issue that can be exploited to create or modify alerts.

Kaspersky published a new advisory on September 17 to inform users that Kaspersky Security 10 for Linux Mail Server is affected by a Redis vulnerability discovered in 2023. “The vulnerability could potentially cause product malfunction or allow an attacker to execute code when processing files of a certain format,” Kaspersky explained.