Active Attacks Turn Check Point VPN and Management Flaws Into an Immediate Patch Priority

Check Point has confirmed exploitation of two critical, unauthenticated vulnerabilities affecting security gateways, Spark firewalls, and management infrastructure. Both flaws carry CVSS v3 scores of 9.8 and can lead to attacker-controlled code execution.

The first issue, CVE-2026-85102, compromises VPN certificate negotiation on Security Gateways. The second, CVE-2026-93616, uses path traversal and file upload to execute arbitrary scripts on management systems.

CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog on September 22, 2026. US federal civilian agencies must remediate them and conduct forensic triage by September 25, 2026.

Two pre-authentication routes into perimeter infrastructure

CVE-2026-85102 is an improper certificate-validation vulnerability in Check Point VPN handling. It affects Security Gateway and Spark Firewall products configured for Site-to-Site VPN or Remote Access VPN.

During VPN negotiation, the affected software does not correctly establish trust in a presented certificate. An unauthenticated remote attacker can exploit that failure to execute arbitrary code on a Security Gateway.

The issue is classified as CWE-295, Improper Certificate Validation. Its CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

That assessment describes a network-accessible attack requiring low complexity, no existing privileges, and no interaction from a user. Successful exploitation can affect the confidentiality, integrity, and availability of the gateway.

CVE-2026-93616 provides a separate route into Check Point management infrastructure. It is a pre-authentication path-traversal vulnerability, classified as CWE-22, that permits an attacker to upload and execute arbitrary scripts.

The affected Management web service may also expose paths for script execution and Java class loading. CISA identifies the affected product families as:

• Check Point Security Management Server
• Check Point Multi-Domain Security Management Server
• Check Point Log Server
• Check Point Multi-Domain Log Server
• Check Point SmartEvent

CVE-2026-93616 has the same 9.8 CVSS score and vector as the VPN flaw. Exact affected software versions and fixed releases for the management products have not been disclosed in the available information.

Exploitation spans gateways, Spark customers, and management servers

Check Point says CVE-2026-93616 has been exploited as a zero-day since July 23, 2026. This means attackers were abusing the management vulnerability before a remedy was generally available or the issue was publicly handled as a known defect.

Separately, the company observed a wave of exploitation attempts against Spark customers beginning September 12, 2026. That activity targeted CVE-2026-85102 and passed through VPN providers, proxies, and other anonymization services intended to obscure its origin.

The Dutch Nationaal Cyber Security Centrum had warned about the Security Gateway vulnerability on September 10, 2026. It advised customers to install the available security updates because exploitation was expected imminently.

Check Point identified three certificate subject strings during the malicious VPN activity:

CN=vpn,OU=users,O=global
CN=vpn-user,OU=users,O=global
CN=vpnuser,OU=users,O=global

Administrators should treat these strings as threat-hunting leads, not definitive evidence or a complete blocking list. Check Point has cautioned that attackers may use other certificate subjects.

The use of generic names also limits their value as standalone indicators. Defenders should correlate matches with VPN negotiation records, source infrastructure, process activity, configuration changes, and other evidence from the affected gateway.

For management systems, hunting should cover unexpected script uploads, Java class loading, and abnormal requests or execution associated with the Management web service. No specific malicious filenames, hashes, source addresses, or attacker attribution have been disclosed.

CISA requires remediation and forensic triage by September 25

CISA placed both flaws in the Known Exploited Vulnerabilities catalog on September 22, 2026. Their inclusion confirms that exploitation is not merely theoretical.

For both CVE-2026-85102 and CVE-2026-93616, the catalog records the following operational requirements:

• Remediation deadline for federal civilian agencies: September 25, 2026
• Forensic triage under BOD 26-04: required
• Known use in ransomware campaigns: unknown
• Required action: apply Check Point’s mitigations while following BOD 26-04 and CISA’s forensic-triage requirements

Organizations must evaluate the internet exposure of each affected asset. For cloud services, they should follow the corresponding BOD 26-04 guidance; if no mitigation is available, CISA advises discontinuing use of the product.

The triage requirement matters because patching closes the vulnerable path but does not establish whether an attacker already used it. Systems exposed since the documented exploitation periods require investigation alongside remediation.

Fixed gateway and Spark releases

For CVE-2026-85102, Check Point recommends installing LivePatch Take 26 on supported Security Gateways running:

• R81.20
• R82
• R82.10

Customers not using LivePatch should deploy one of these Jumbo Hotfix levels, or a later release:

Software branch	Fixed Take
R81.20	Take 166
R82	Take 126
R82.10	Take 44
R81.10	Take 190

Spark firewalls should be upgraded to one of the following versions or later:

• R82.00.10 Build 2325
• R81.10.17 Build 4968

Administrators can check whether LivePatch is active by running the following command in expert mode on the Security Gateway:

cpinfo -y CPupdates

Installing an earlier offline LivePatch package is not sufficient in every case. Check Point says customers using such a package may still need Take 26 for complete protection.

For CVE-2026-93616, Check Point has issued separate mitigation and threat-hunting guidance for the Management web service. The technical contents of those instructions are not available here, so administrators should obtain the current vendor guidance rather than assume the gateway patches also protect management products.

Network restrictions can reduce VPN exposure

When administrators cannot update immediately, Check Point recommends disabling VPN implied rules and replacing them with explicit access rules.

For Site-to-Site VPN deployments, inbound access to the following ports should be limited to the known IP addresses of authorized peers:

• UDP/500
• UDP/4500

Remote Access VPN configurations should expose only services required by the deployment:

• UDP/500
• UDP/4500
• TCP/443
• TCP/80, where applicable

Where operationally possible, organizations should also restrict permitted source-client ranges. These controls narrow the systems able to reach the vulnerable VPN services, but they do not replace the fixed software.

The network-level mitigations do not apply to locally managed Spark firewalls. Those devices require the applicable update or another mitigation expressly supported by Check Point.

What defenders should verify now

Asset owners should first identify every internet-facing Check Point gateway, Spark firewall, management server, log server, and SmartEvent system. Inventory data must include the installed release, Take or build level, management role, VPN configuration, and external exposure.

For gateways, defenders should confirm that LivePatch Take 26 or a listed fixed Jumbo Hotfix is installed. Spark deployments need at least the specified R82.00.10 or R81.10.17 build.

Teams should then review historical and current telemetry for the three observed certificate subjects, suspicious connections through anonymization infrastructure, unexpected script uploads, and abnormal Management web-service behavior. A certificate match alone should not determine the incident verdict.

Finally, potentially affected systems need forensic triage even after patching. The two vulnerabilities offer unauthenticated paths into devices positioned at the network perimeter and within centralized security management, giving successful attackers access to infrastructure that organizations rely on to enforce and observe their defenses.