CISA - Experts & Thought Leaders

A vendor of cybersecurity solutions, Check Point Software Technologies, has issued emergency fixes for its SmartConsole management application for a “critical” zero-day vulnerability. The bug, dubbed CVE-2026-16232, is being weaponized by attackers who are trying to gain full access to enterprise security management systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its ‘Known Exploited Vulnerabilities’ (KEV) list and mandated its patching in federal civilian agencies in its Binding Operational Directive (BOD) 26-04. Re-configure firewall policies The vulnerability, CVE-2026-16232, has a CVSS score of 9.3 (Critical) and is a result of improper authentication (CWE-287). It allows an unauthenticated remote attacker to get a valid application login token without providing any credentials. The attacker can use this token to log into SmartConsole as an admin. From there, threat actors can re-configure firewall policies, re-configure security, and then move deeper into enterprise networks. CheckPoint researchers discovered the vulnerability in the context of their BLAST (Business Logic Attack Surface Testing) research to evaluate the readiness of AI for business use and they have observed live attacks on this vulnerability. The vendor has stated that they have already issued private notifications on these customers. IP-based restriction This is the newest of Check Point’s list of problems pointed out by U.S. authorities, and it is being called CVE-2026-16232. In June, CISA released a June call to action for federal agencies to address two vulnerabilities, CVE-2026-50751 (authentication bypass for Remote Access VPN and Mobile Access) and CVE-2026-50765 (Elevation of Privilege for Remote Assistance) that could allow for ransomware attacks. CISA has classified CVE-2024-24919 as an actively exploited vulnerability for Check Point’s Quantum Security Gateways in 2024. Key Exposure Condition: Attack is successful only if the Security Management Server or Multi-Domain Management (MDS) instance is directly connected with the public Internet without any IP-based restriction. Core affected components The following tracks are considered as major releases and are affected by vulnerability: Check Point Software Versions: R81.10, R81.20, R82 and R82.10 (Previous versions of the release trains may be affected too). Core Affected Components: Security Management Server, Multi-Domain Security Management (MDS), and SmartConsole GUI interfaces are Core Affected Components. In addition to CVE-2026-16232, Check Point revealed two non-exploited side vulnerabilities that it found during the internal audit: CVE-2026-62144 (CVSS 9.3): Management servers authentication bypass and privilege escalation. CVE-2026-62145 (CVSS 7.5): Local privilege escalation vulnerability in GaiaOS WebUI, Firewall and Multi-Domain Log Servers. High‑severity vulnerabilities Security teams should take a peek at the SmartConsole logs in Logs & Monitor > Logs & Events > Audit Logs View to see who is accessing the network. Pay attention to logins with the following authentication type: application token and external ip address is untrusted. CheckPoint and CISA identified the following IP addresses used to attempt to exploit and conduct reconnaissance: In the vulnerabilities disclosure, Check Point has released a Jumbo Hotfix for July 22 to address two additional high‑severity vulnerabilities, CVE-2026-62144 (authentication bypass and privilege escalation in management products) and CVE-2026-62145 (local privilege escalation in GaiaOS WebUI and other components). The Hotfix should be applied as soon as possible. Check Point and CISA recommend patching is not implemented right away, and instead, hardening is recommended: Only trusted IP addresses and subnets are allowed to access and control SmartConsole. Use firewall rules and network filters to block Internet access to block management interfaces. Make sure that implied control-connection rules are enabled on and trusted clients are limited. Follow Check Point’s Gateway and Management Hardening Best Practices. Regularly check Check Point’s IoC in SmartConsole and network logs.

The Department of Homeland Security (DHS), through the Federal Emergency Management Agency (FEMA) and the Cybersecurity and Infrastructure Security Agency (CISA), announced more than $18.2 million in Tribal Cybersecurity Grant programme (TCGP) awards to assist Tribal Nations with managing and reducing systemic cyber risk and threats. These are the first-ever Tribal Cybersecurity Grants to be awarded. The grant programme was established by the Bipartisan Infrastructure Law and the more than 30 grant awards represent the largest number of awards ever provided by the Department to Tribal Nations in a single grant programme. Addressing digital and cybersecurity threats “For far too long, Tribal Nations have faced digital and cybersecurity threats without the resources necessary to build resilience,” said Secretary of Homeland Security Alejandro N. Mayorkas. “The Department of Homeland Security’s first-ever Tribal Cybersecurity Grant programme awards announced today, made possible by President Biden’s Bipartisan Infrastructure Law will help tribes and tribal communities ensure they have the tools to assess risks, implement solutions, and increase cyber defences.” Cybersecurity challenges Digital threats impacting American Indian and Alaska Native tribes are becoming more complex Digital threats impacting American Indian and Alaska Native tribes are increasing and becoming more complex, and tribal sovereignty creates unique cybersecurity challenges for these communities that have been consistently underfunded and under-resourced. This programme is another example of a unified approach across DHS. This FEMA-administered programme leverages CISA’s capabilities to support grant recipients. Cybersecurity resilience “With these first-ever Tribal Cybersecurity Grants, we are not just addressing immediate needs, but also reinforcing the infrastructure that supports the sovereignty and resilience of Tribal Nations,” said FEMA Administrator Deanne Criswell. “This funding, benefitting the largest number of tribal recipients to build cybersecurity resilience in FEMA’s history, is a testament to our dedication to a safer, more secure future for all communities." “These grants will help Tribal Nations combat the growing cyber threats they face every day and build resilience for their critical infrastructure,” CISA Director Jen Easterly said. “We’re proud to work with our federal partners to help Tribal Nations strengthen their cybersecurity.” Tribal Cybersecurity Grant programme The Tribal Cybersecurity Grant programme will fund efforts to establish critical governance frameworks for Tribal Nations to address cyber threats and vulnerabilities, identify key vulnerabilities and evaluate needed capabilities, implement measures to mitigate the threats, and develop a 21st-century cyber workforce across local communities. All Tribal Cybersecurity Grant programme recipients are required to participate in a limited number of free services provided by CISA. These services are: Cyber Hygiene Vulnerability Scanning – Evaluates external network presence by continuously scanning public, static internet protocols (IPs) for accessible services and vulnerabilities. Nationwide Cybersecurity Review – A free, anonymous, annual self-assessment designed to measure gaps and capabilities of a recipient’s cybersecurity programmes. Cybersecurity risks protection The grants will significantly improve national resilience to cyber threats by giving Tribal Nations much-needed resources to address network security and take steps to protect against cybersecurity risks to help them strengthen their communities. In addition, federally recognised tribes are eligible to apply for millions more in tribal cybersecurity funding that will be announced later in 2024.

ASIS International, the world’s largest association for security management professionals, has announced its programming lineup for Global Security Exchange (GSX) 2024 with in-person and digital experiences taking place 23-25 September at the Orange County Convention Centre in Orlando, FL and via the online GSX event platform. "Pioneering this year’s Selection Committee has been a privilege," said Dr. Diana M. Concannon, PsyD, PCI, CTM, 2024 GSX Selection Committee Chair. "Our exceptional educational lineup at this year’s event reflects the collective dedication of our globally diverse team of volunteers who served alongside me in a highly rigorous review process. Together, we've meticulously curated over 200 sessions, diving deep into contemporary security challenges, and pioneering innovative solutions. I look forward to connecting with you there!”  General session presentations GSX will offer timely general session presentations from acclaimed global keynote speakers. This year’s general session lineup is:  Monday 23 September Strategic Diplomacy: Charting Paths in a Rapidly Changing World|Sanna Marin, Former Prime Minister of Finland   Marin highlights the indispensable role of democratic alliances in facing significant threats As the youngest Prime Minister globally, Sanna Marin expertly guided Finland through a dynamic geopolitical arena. From navigating the global pandemic to swiftly pioneering Finland into NATO after the Russian invasion of Ukraine and addressing the urgent climate crisis, Ms. Marin’s tenure encapsulates pivotal moments in contemporary history. In this insightful discussion, Marin delves into the intricate facets of key geopolitical challenges, notably the Russian assault on Ukraine and Finland’s consequential entry into NATO.  With a keen focus on security and international relations, Marin highlights the indispensable role of democratic alliances in facing significant threats. She articulates strategies for mitigating dependencies on authoritarian regimes while advocating for the reinforcement of partnerships, resilience, and trust as essential components in adapting to the ever-evolving geopolitical landscape.   Tuesday 24 September Shields Ready – Why Resilience is the Most Important Security Measure for Critical Infrastructure|Jenn Easterly, Director, Cybersecurity and Infrastructure Security Agency (CISA) Impacts of such malicious cyber activity would likely go beyond network intrusion and data theft The U.S. intelligence community and closest geopolitical allies are in resounding agreement on who is the largest global security threat of the twenty-first century: The People’s Republic of China (PRC). They’ve warned that the PRC is almost certainly capable of launching cyberattacks that could disrupt the critical infrastructure Americans rely on daily, such as oil and gas pipelines, rail systems, and healthcare facilities. The impacts of such malicious cyber activity would likely go beyond network intrusion and data theft – with the potential to jeopardise the physical security of the institutions and the public. And in a Presidential election year, the PRC’s attempts to influence U.S. election operations is anticipated to exceed those already detected from previous cycles.  As America’s cyber defence agency and the national coordinator for critical infrastructure security and resilience, CISA is driving proactive risk reduction efforts in the face of these most pressing threats. Join CISA Director Jen Easterly for a discussion on how they can broaden the resilience investments and utilise collaborative partnerships – across industry, government, and communities – to ensure the nation is secure and increase the ability to respond and recover to the ever-evolving threat landscape presented by the greatest adversaries.   Wednesday 25 September Leadership and Accountability When It Matters|Commander Kirk Lippold, United States Navy (RET.)    Navigating the dual facets of privilege and burden in leadership demands a level of accountability that many aspire to achieve. In the aftermath of a harrowing suicide terrorist attack, Commander Kirk Lippold intricately weaves the principle of integrity into a narrative that extends beyond crisis management. He reveals how this principle fosters a diverse and inclusive environment, empowering his crew with a profound sense of ownership. In this crucible of combat, personal accountability and leadership become guiding principles. Lippold’s “Pillars of Leadership” emerge not only as invaluable business tenets but essential foundations for any team weathering challenges. GSX’s multi-faceted approach Newly announced GSX session lineup includes in-depth looks at timely issues Encompassing 200+ sessions tackling vital issues in the security profession, the newly announced GSX session lineup includes in-depth looks at timely issues within the following focus areas: Crime, Digital Transformation, Information Security, Law and Ethics, Managing Organisations, National Security, Physical and Operational Security, Professional Development, and Risk Management.  “GSX is a crucial global gathering for security professionals,” said Cy A. Oatridge, CPP, 2024 ASIS International President. “GSX’s multi-faceted approach with best-in-class education, an industry-pioneering exhibit hall featuring innovative solution providers, ample networking opportunities, and digital programming allows our attendees from across the globe the chance to elevate their knowledge, skills, and networks.” GSX education sessions  GSX 2024 will feature multiple pre-conference events on Saturday and Sunday In addition to the conference’s primary programming, GSX 2024 will feature multiple pre-conference events on Saturday and Sunday, including two-day workshops on facility security design and ESRM, APP, CPP, and PSP certification reviews, and Secure Horizons: An Immersive Experience for Senior Security Executives. Sunday’s pre-conference programming will include workshops on ESRM and stakeholder communication, ASIS Volunteers’ Day, and the ASIS Awards of Excellence and the Outstanding Security Performance Awards (OSPAs).  GSX education sessions include expert-led deep dives that can improve the practice of security professionals at any stage of their career, covering topics such as artificial intelligence, ESRM best practices, diversity, equity and inclusion (DEI), active assailants and workplace violence, cybersecurity, business continuity and crisis management, crime prevention, and more. All-Access Pass registrants can earn up to 22 CPEs toward their recertification whether they attend the in-person or digital experience. Advanced-level Game Changer session Each day of the conference will also feature an advanced-level Game Changer session designed to explore trends that will shape the security industry’s future. Monday’s session is titled “Knocked Down, Not Knocked Out: Building Organisational Resilience,” Tuesday’s session is “Do You Trust Me? How to Thrive in a Mistrustful Era,” and “When Chaos Reigns: The Critical Role of Security in Global Crises” will cap the game changer sessions on Wednesday.  Digital attendees will be able to access online GSX session recordings through 31 December. In-person attendees can add digital access to captured content to their registration. The complete digital session lineup will be announced shortly. More details about the GSX 2024 exhibit hall, which will feature approximately 500 companies highlighting drones, cybersecurity, robotics, and uncrewed systems; Career HQ, which will focus on career development; and the digital programming slate will be announced in the coming weeks.