SandBlast Agent Protects Against BlueKeep RDP Vulnerability - Check Point Blog

Recently, a security advisory was released for a vulnerability in RDP (Remote Desktop Protocol) affecting multiple Windows Operating Systems prior to 8.1. According to Microsoft’s advisory, this vulnerability can be exploited for both remote code execution and denial of service attacks. All this without needing the credentials of the target machine.

Check Point’s SandBlast Agent Anti-Exploit now monitors the RDP service for both Windows 7 and Windows 2008R2 and is able to prevent this attack from occurring. Not only is SandBlast Agent able to prevent the exploit from being delivered on unpatched systems, but it is also able to prevent the exploit from being delivered to the previously vulnerable driver in patched systems.

The protection is available in SandBlast Agent’s E80.97 Client Version (Can be downloaded from sk154432).

To see Anti-Exploit’s protection in action please see the following video, where our Threat Research Group’s POC used for exploitation is blocked. In addition, you can also see how we are able to block the scan of the Metasploit module that was recently developed to identify vulnerable systems.

WATCH: SandBast Agent protects against Check Point’s Threat Research group BlueKeep based exploit

Check Point SandBlast Agent Protects Against BlueKeep Vulnerability - YouTube

Check Point SandBlast Agent Protects Against BlueKeep Vulnerability

SandBlast Agent BlueKeep Event Forensics Report:

Security Advisory – Action Required – July 2026 Security Update

As part of Check Point’s Frontier AI Readiness Program, we ...

90% of the World’s Businesses are SMEs and MSMEs and AI Is Reshaping Both Their Future and Their Risk

Every year on June 27, the world marks the United ...

OpenAI Frontier AI Models Powering Check Point’s Leading Cyber Security Solutions

Check Point already leverages AI, machine learning and other advanced technologies in ...

Security Advisory – Action Required – Active Exploitation of Check Point VPN Authentication Bypass (CVE-2026-50751)

Check Point Research has identified active exploitation of CVE-2026-50751, a ...