Research.Checkpoint Ransomware and Vulnerabilities Targeting Ivanti and Check Point Systems
Article Content
Browse articles 
On February 9, 2026, Check Point reported on active ransomware threats and vulnerabilities affecting Ivanti Endpoint Manager. Specifically, CVE-2026-1281 and CVE-2026-1340 were published on January 29, 2026, with CVE-2026-1281 being actively exploited as of the same day. Check Point Harmony Endpoint and Threat Emulation are providing protection against these threats.
Ask AI about this cluster
Answers cite the sources they use
Updated 228d ago How this analysis works
Timeline
2024-05-26
First public exploit for CVE-2025-8088 released
2025-11-03
CVE-2025-11953 published
2026-01-29
CVE-2026-1281 and CVE-2026-1340 published
2026-01-29
CVE-2026-1281 added to CISA KEV (active exploitation)
2026-02-01
First public PoC for CVE-2026-1281
2026-02-05
CVE-2025-11953 added to CISA KEV (active exploitation)
More articles in this cluster (1)
Following this threat?
Track Akira, APT41 and CVE-2025-11953 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Attackers Exploit MFA Gaps in SonicWall VPN Access On August 4, 2026, an Akira ransomware affiliate successfully accessed a SonicWall SSL VPN by spraying passwords, exploiting the lack of multi-factor authentication (MFA). After gaining access, the attacker used RDP to reach the domain controller and enumerate Active Directory, although the ransomware deployment… 
Huntress Analyzes Akira Ransomware Attack After EDR Failure In September 2026, Huntress deployed its agent at an organization already compromised by Akira ransomware. The post-compromise installation meant crucial EDR telemetry was missing, hindering initial access insights. Researchers reconstructed the attack using Windows Event Logs, Registry artifacts, and Akira log files.…