Check Point customers are dealing with two actively exploited critical flaws at once. CVE-2026-93616 is a pre-authentication path traversal in the Security Management web service, exploited as a zero-day since July 23 and only patched September 22. CVE-2026-85102 is a pre-authentication RCE in Security Gateway VPN certificate handling, patched September 9 and under exploitation since September 12. Both score CVSS 9.8, and both landed in the CISA KEV catalog on September 22 with a September 25 federal deadline. If you run Check Point management or gateways, this is a patch-and-hunt week, not a patch week.
What happened
- July 23, 2026: Check Point Research later confirmed the first “pinpointed” exploitation attempts against management servers using CVE-2026-93616. It stayed a zero-day for two months.
- September 9, 2026: Check Point disclosed and fixed CVE-2026-85102 in gateway VPN certificate handling. At the time, no exploitation was known.
- September 10, 2026: The Dutch NCSC warned about the VPN flaw.
- September 12, 2026: An exploitation wave began, primarily against customers of Spark, Check Point’s small-business firewall line, globally.
- September 22, 2026: Check Point published the CVE-2026-93616 fix and confirmed active exploitation of both flaws. CISA added both to the KEV catalog, in the same batch as F5’s exploited BIG-IP APM zero-day.
Affected versions
CVE-2026-93616 hits the management plane: Security Management Server, Multi-Domain Security Management, Log Server, Multi-Domain Log Server, SmartEvent, and standalone appliances with management components.
| Product line | Vulnerable | Fixed |
|---|---|---|
| Management R82.20 | base release | Security Hotfix Take 1 |
| Management R82.10 | JHF Take 44 or lower | JHF Take 45 |
| Management R82 | JHF Take 126 or lower | JHF Take 127 |
| Management R81.20 | JHF Take 166 or lower | JHF Take 170 |
| Management R81.10 | JHF Take 190 or lower | JHF Take 192 |
| Management R80 to R80.40 | all (end of support) | upgrade only |
| Gateway R81 to R82.10 | R81, R81.10.X, R81.20, R82, R82.00.X, R82.10 | LivePatch Take 26, or the JHF takes above (166/126/44/190) |
| Spark | earlier builds | R82.00.10 Build 2325, R81.10.17 Build 4968 |
Two traps in there. LivePatch Take 28 and 29 do not fix the management flaw. The JHF takes that fixed the gateway VPN flaw on September 9 are exactly the highest takes still vulnerable to the management flaw: a gateway patched two weeks ago does not mean your management server is patched now. Verify LivePatch state with cpinfo -y CPupdates per Check Point’s fix guidance in SK1000117.
How the attacks work
Management (CVE-2026-93616). The management web service on TCP/19009 improperly restricts filesystem paths in requests. An unauthenticated attacker can execute a script from an arbitrary path and load an arbitrary Java class. A management server compromise is a policy-plane compromise: the attacker can change firewall policy for every gateway that server manages.
Gateway VPN (CVE-2026-85102). During VPN negotiation, the gateway improperly validates certificate data, giving unauthenticated RCE. Observed attacks came from anonymization infrastructure using self-styled certificates with subjects CN=vpn,OU=users,O=global, CN=vpn-user,OU=users,O=global, and CN=vpnuser,OU=users,O=global. Attribution has not been published for either flaw.
Detection
Both flaws map to ATT&CK T1190, Exploit Public-Facing Application. Check Point’s own guidance: hunt for anomalous certificate-based Mobile Access logins and internal port scans from logged-in VPN users, and use the IOC list in SK1000171 for the management flaw.
The highest-signal artifact is the attacker certificate subjects in VPN logs.
Data source: Check Point logs via Log Exporter to Splunk (field names follow the Check Point Add-on’s CIM mapping; adjust index/sourcetype to your ingestion)
index=* sourcetype="cp_log"
| search ("CN=vpn,OU=users,O=global" OR "CN=vpn-user" OR "CN=vpnuser")
| stats count, values(action) AS actions, min(_time) AS first_seen, max(_time) AS last_seen BY src, dest, user
| convert ctime(first_seen), ctime(last_seen)Data source: CommonSecurityLog (Microsoft Sentinel), Check Point forwarding via CEF
CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DeviceVendor == "Check Point"
| where AdditionalExtensions has_any ("CN=vpn,OU=users,O=global", "CN=vpn-user", "CN=vpnuser")
or Message has_any ("CN=vpn,OU=users,O=global", "CN=vpn-user", "CN=vpnuser")
| summarize Hits = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP
| order by Hits descFor the management server, watch the service port and the box itself: connections to TCP/19009 from IPs that are not your administrators, new or modified scripts and Java class files, suspicious child processes of management services, and administrative or policy changes nobody made.
Tuning honestly: the certificate CN strings are specific to the observed campaign and will age out. A quiet query does not clear you, and attackers can mint different subjects. CN=vpn substrings can also collide with legitimate certs in some environments; anchor on the full OU=users,O=global form first. The management-side behaviors (odd 19009 sources, unexplained policy changes) survive tooling changes better than any IOC. Review the whole window: July 23 onward for management, September 12 onward for gateways.
Mitigation
- Patch per the table above: SK1000117 for gateways, SK1000171 for management. Confirm the installed take, not the intended one.
- Cannot patch a gateway today: restrict VPN rules to known peer IPs and limit source client ranges where feasible.
- Management plane: restrict TCP/19009 to trusted IPs and use SmartConsole’s Trusted Clients (Manage & Settings → Permissions & Administrators → Trusted Clients). A management server should never be reachable from the internet.
- Management server exposed since July 23: treat it as potentially compromised. Hunt with the SK1000171 IOCs, validate every administrative action in the window, rotate credentials and certificates, and review managed gateways for policy changes you did not make. Patching does not undo a policy an attacker already pushed.
Bottom line
Patch both planes this week and treat the takes carefully: the September 9 gateway patch level is still vulnerable on the management side. Then hunt: certificate subjects in VPN logs back to September 12, and management-server artifacts back to July 23.