Check Point CVE-2026-93616 and CVE-2026-85102 Exploited: Patch Now

Check Point is urging customers to patch two critical, actively exploited vulnerabilities right away. CVE-2026-93616 is a zero-day in Check Point’s Security Management server that lets an unauthenticated attacker upload and run scripts, and it was fixed on September 22, 2026. CVE-2026-85102 is a remote code execution flaw in Security Gateway and Spark firewall VPN certificate handling; it was patched on September 9 and attackers began exploiting it on September 12. Both are rated CVSS 9.8, and CISA added both to its Known Exploited Vulnerabilities catalog on September 22 with a remediation deadline of September 25.

What happened

On September 22, Check Point published a security advisory on its corporate blog, signed by Lotem Finkelstein, VP Research. It covers two separate problems that attackers are now using at the same time. The first is a vulnerability Check Point had already fixed. The second is a zero-day that Check Point Research found being used in a small number of targeted attacks.

According to the Check Point security advisory on active exploitation, the gateway bug CVE-2026-85102 was disclosed and fixed on September 9, 2026, when the company says it had no evidence of exploitation. It is now seeing exploitation attempts against Check Point Spark customers around the world. The management-server bug CVE-2026-93616 is new, and the fix came out with the advisory.

“CVE-2026-93616 is a newly discovered zero-day vulnerability in Security Management”

The two bugs hit different parts of a Check Point deployment. CVE-2026-85102 affects the gateways that terminate VPN traffic at the network edge. CVE-2026-93616 affects the management and logging servers that hold policy for the entire estate. An organization running both, which describes most Check Point customers, has to patch in two places.

CVE-2026-93616: the Security Management zero-day

Check Point’s support article sk1000171 for CVE-2026-93616 describes a directory traversal and file upload vulnerability that lets an unauthenticated attacker upload and execute arbitrary scripts on the Management Server. The blog adds that the flaw lives in the Check Point Management web service and lets an attacker run a script from an arbitrary path and load an arbitrary Java class. No login is required.

The vendor says the bug has been “exploited in the wild” and that it knows of a handful of customers who were attacked. It dates the observed attacks to July 23, 2026, which means the flaw was used as a zero-day for about two months before a patch existed.

Which products are affected

• Security Management Server
• Multi-Domain Security Management Server
• Log Server and Multi-Domain Log Server
• SmartEvent

Check Point lists Smart-1 Cloud (where the fix has already been applied), Check Point firewall appliances and Check Point Spark firewalls as not affected by this CVE.

Affected and fixed versions

Two details matter here. First, Check Point says LivePatch Take 28/29 does not address this issue, and because of the nature of the fix, no LivePatch will be released for it. Customers who rely on LivePatch for fast gateway fixes have to install a Jumbo Hotfix or the R82.20 hotfix on their management servers. Second, the new Jumbo Hotfix takes also include the fix for CVE-2026-91843 (sk1000155). The NVD entry for CVE-2026-91843 describes it as a stack overflow in the unauthenticated login process that may allow remote code execution with root privileges, also rated CVSS 9.8.

CVE-2026-85102: the VPN certificate flaw now hitting Spark firewalls

The gateway bug is tracked in Check Point sk1000117. Improper validation of certificate data during VPN negotiation may let an unauthenticated remote attacker execute arbitrary code on the Security Gateway. The CVSS score is 9.8.

Exposure depends on how the VPN is set up:

• Remote Access VPN on an affected Security Gateway or Spark firewall is in scope.
• Site-to-Site VPN is affected only when the gateway uses or allows certificate-based authentication. Check Point notes that VPN communities containing Dynamic IP (DAIP) gateways or Large Scale VPN (LSV) gateways enable certificate authentication.
• Gateways that only take part in encryption communities using a pre-shared key are not vulnerable.

Affected versions are R81.20, R82 and R82.10, plus the end-of-support R80 through R81.10 releases and Spark firmware lines R81.10.x and R82.00.x. R82.20 is listed as not affected.

In a September 20 update to the article, Check Point says the vulnerability is actively exploited on Spark firewalls as of September 12, 2026. The blog adds that the attempts came from anonymization infrastructure, including VPN services and proxies.

How to patch the gateways

If you already installed the offline LivePatch package earlier in September, check your Jumbo Hotfix level. A September 14 update says customers on R82.10 Take 24 or lower, R82 Take 107 or lower, or R81.20 Take 146 or lower must install LivePatch Take 26, because Check Point found a rare scenario where the earlier package does not fully cover the CVE.

To confirm the patch is active, Check Point says to run cpinfo -y CPupdates in Expert mode and look for the Take 26 bundle. On a gateway or ClusterXL member, cplp list should list the cpcert, iked, vpn, vpnrad and cprid components against both CVE-2026-85102 and CVE-2026-85103. On a Scalable Platform Security Group, run g_all cplp list. According to NVD, CVE-2026-85103 is a companion heap-based buffer overflow in VPN certificate ASN.1 decoding, also rated 9.8, and the same LivePatch fixes it.

How to tell if you are affected

Start with inventory. Every Security Management, Multi-Domain, Log, Multi-Domain Log and SmartEvent server below the fixed takes is exposed to CVE-2026-93616, and the risk is highest when the management web service can be reached from untrusted networks. Every gateway or Spark appliance running Remote Access VPN, or Site-to-Site VPN with certificate authentication, below the fixed versions is exposed to CVE-2026-85102.

Check Point has not published a count of affected customers beyond “a handful” for the management zero-day, and it describes the Spark activity as global.

Indicators of compromise and how to hunt

Management servers (CVE-2026-93616)

Check Point gives two checks to run from Expert mode on every management and log server:

1. Search the cpm.elg logs in $MDS_FWDIR/log/ for SmartConsole login requests with a username longer than 1,000 characters. If you find any, check /var/log/dump/usermode/ for an FWM or MDS core dump created at the same time. A matching core dump points to a possible exploitation attempt.
2. Search the same logs for ERROR entries from upgrade.base.ReflectionUtils reading “Failed to load allResourceFiles map from”. Any file path in that output containing directory traversal sequences such as ../ may indicate an attempt to exploit the bug.

The exact grep commands are in sk1000171. Treat a hit as a reason to start incident response, not just to patch. Patching closes the hole but does not remove anything an attacker already placed on the server.

Gateways and Spark (CVE-2026-85102)

In SmartConsole or Spark Management, open Logs & Monitor (or Logs & Events) and search for certificate-based Mobile Access logins after September 12, 2026, using the query product: "Mobile Access" AND action: "Log In" AND "Certificate". Look for unrecognized users, clients or source IP addresses. Check Point lists three certificate subjects seen so far, and it warns that the list is not exhaustive:

• CN=vpn,OU=users,O=global
• CN=vpn-user,OU=users,O=global
• CN=vpnuser,OU=users,O=global

If a login is unauthorized, the company says to look for follow-on activity from that user, such as scans of internal ports and services.

Mitigations if you cannot patch today

For the management zero-day, Check Point’s advice is to put Management Servers behind a Security Gateway, following its Gateway and Management Hardening guide. Make sure TCP port 19009 can only be reached from trusted IP addresses. If a gateway with implied rules already protects the server, restrict Trusted Clients to trusted internal addresses. In SmartConsole, that setting is under Manage & Settings > Permissions & Administrators > Trusted Clients. Restricting Trusted Clients creates an implied rule that limits access.

For the VPN flaw, Check Point describes a workaround for systems that cannot take a Jumbo Hotfix or LivePatch, and warns that a mistake can break connectivity:

• Site-to-Site VPN: disable the VPN implied rules and manually allow UDP/500 and UDP/4500 only from specific peer IP addresses (see sk179346).
• Remote Access VPN: disable the Remote Access implied rules and create explicit access rules for UDP/500 (IKE), UDP/4500 (NAT-T), TCP/443 and, where needed, TCP/80, limited to your clients’ source ranges if possible.

These workarounds are not available on locally managed Spark firewalls, and that is where exploitation is happening. For those appliances, updating to the fixed firmware builds is the only listed fix.

CISA KEV listing and the September 25 deadline

CISA added both CVEs to the Known Exploited Vulnerabilities catalog on September 22, 2026, with a due date of September 25, 2026. An exploited F5 BIG-IP APM flaw was added to the catalog on the same date, with the same deadline. The catalog entries tell agencies to apply vendor mitigations under Binding Operational Directive 26-04, which sets patch timelines based on asset exposure, KEV status, whether exploitation can be automated, and the technical impact. Both entries are also flagged for CISA’s forensic triage requirements. Agencies are told to follow BOD 26-04 guidance or stop using the product if no mitigation is available. The directive only binds federal civilian agencies, but the three-day window shows how urgently CISA rates these flaws.

Timeline

What to do now

1. List every Check Point management, log and SmartEvent server, and every gateway and Spark appliance, with its version and Jumbo Hotfix take.
2. Patch management servers to the R82.20 Security Hotfix or the fixed Jumbo Hotfix takes. Do not count on LivePatch for CVE-2026-93616.
3. Patch gateways with LivePatch Take 26 or the fixed Jumbo Hotfix takes, and update Spark firmware to the fixed builds. Verify with cplp list.
4. Restrict access to the management web service and TCP/19009 to trusted addresses, whatever your patch status.
5. Run the log checks above and review certificate-based Mobile Access logins since September 12.
6. If anything looks suspicious, escalate to incident response and contact Check Point Support.

The bottom line: this is a two-front problem. The VPN bug has had a public fix for two weeks and is now being exploited against Spark customers worldwide. The management zero-day has been used quietly against select targets since July. Patch both, and check your logs even if you patched promptly.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage