Check Point VPN Flaws Are Under Active Attack — Patch Now

Check Point has confirmed active exploitation of two critical, unauthenticated vulnerabilities in its VPN and management products, and CISA's deadline for federal agencies to patch them is today, September 25. CVE-2026-85102 lets an attacker run code on a Security Gateway or Spark Firewall without valid credentials during VPN negotiation, and CVE-2026-93616 lets an attacker upload and run scripts on a Management Server through a path traversal flaw — one that turns out to have been exploited as a zero-day since July, months before a patch existed.

Key Takeaways

• CVE-2026-85102 (CVSS 9.8) is an improper certificate-validation flaw in Check Point Security Gateway and Spark Firewall VPN handling, letting an unauthenticated attacker execute code during VPN negotiation.
• CVE-2026-93616 (CVSS 9.8) is a pre-authentication path traversal and file-upload flaw in Check Point's Management web service, affecting Security Management Server, Multi-Domain Security Management Server, Log Server, and SmartEvent.
• Check Point patched CVE-2026-85102 on September 9 with no known exploitation at the time, then confirmed attacks against Spark Firewall customers starting September 12, using VPN and proxy infrastructure to hide their origin.
• CVE-2026-93616 had already been exploited as a zero-day since July 23, well before this week's disclosure and fix.
• CISA added both flaws to its Known Exploited Vulnerabilities catalog and set September 25, 2026 as the deadline for federal agencies to patch or mitigate.

What do these two flaws actually do?

CVE-2026-85102 lives in how Check Point's Security Gateway and Spark Firewall validate certificate trust during VPN negotiation. Get the validation logic wrong and an attacker doesn't need a password at all — they can present a crafted certificate and run arbitrary code on the gateway itself. It affects deployments using Remote Access VPN or certificate-based Site-to-Site VPN, which covers a lot of Check Point's install base.

CVE-2026-93616 is a different kind of problem in a different product: a pre-authentication path traversal and file-upload vulnerability in the Management web service. Rather than the firewall gateway itself, this one targets the Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent — the systems that centrally administer firewall policy across an organization. An attacker who can upload and execute a script there isn't compromising one gateway; they're compromising the console that controls all of them.

How long has this actually been under attack?

Longer than the patch timeline suggests. Check Point fixed CVE-2026-85102 on September 9 and initially said it had no evidence of exploitation. The Dutch National Cyber Security Centrum flagged the flaw the following day, warning that exploitation looked imminent given how quickly attackers typically weaponize this kind of certificate-validation bug. That warning held up: Check Point confirmed a wave of exploitation attempts against Spark Firewall customers starting September 12, three days after the patch shipped, using VPN services and proxy networks to mask where the attacks were coming from.

CVE-2026-93616 is the more uncomfortable timeline. Check Point says it's been exploited as a zero-day since July 23 — nearly two months of active attacks against a flaw nobody outside the attackers knew existed, in a product that manages security policy for entire organizations.

How can you tell if you've already been hit?

Check Point published specific certificate subject names observed in the CVE-2026-85102 attacks, though the company is clear these are just what's been seen so far, not an exhaustive list:

• CN=vpn,OU=users,O=global
• CN=vpn-user,OU=users,O=global
• CN=vpnuser,OU=users,O=global

Check Point recommends reviewing Mobile Access logs for anomalous certificate-based VPN logins matching these patterns, and watching for internal port scanning or service discovery immediately following a suspicious login — a common sign of second-stage activity once an attacker has a foothold. For the management-server flaw, Check Point's own support guidance covers separate hunting steps specific to that component.

What's the fix, and is there a workaround?

For CVE-2026-85102, Check Point recommends installing LivePatch Take 26 on supported R81.20, R82, or R82.10 gateways, or updating to a fixed Jumbo Hotfix: R81.20 Take 166, R82 Take 126, R82.10 Take 44, or R81.10 Take 190 or later. Spark Firewalls need R82.00.10 Build 2325 or R81.10.17 Build 4968 or later. Notably, customers who already applied an earlier offline LivePatch package still need Take 26 specifically for full coverage — worth double-checking even if you think you're already patched. Admins can verify LivePatch is active by running cpinfo -y CPupdates in expert mode on the gateway.

If you can't patch immediately, Check Point's interim advice is to disable the VPN implied rules and write explicit rules restricting Site-to-Site VPN on UDP/500 and UDP/4500 to known peer IPs, and to limit Remote Access VPN to only the required services and, where possible, known client IP ranges. That workaround doesn't apply to locally managed Spark firewalls, though — those need the firmware update directly. For CVE-2026-93616, Check Point points to R82.20 Security Hotfix or supported Jumbo Hotfix versions; LivePatch Take 28 and Take 29 do not cover this flaw, and no LivePatch is available for it given the nature of the fix required.

Is this a one-off, or a pattern with Check Point?

A pattern. Check Point has disclosed and patched several actively exploited vulnerabilities in its VPN and management products this year: CVE-2026-50751, an IKEv1 authentication bypass tied to at least one confirmed Qilin ransomware affiliate intrusion, in June; a SmartConsole authentication bypass, CVE-2026-16232, in July; and now these two in September. Perimeter VPN and firewall management systems keep showing up as attack targets for the same reason they keep showing up in Webman's coverage of Cisco, SharePoint, and Oracle EBS flaws this year: they sit at the network edge with broad internal access, which makes them worth far more to an attacker than the effort of finding a bug in them.

Wrapping Up

If you run Check Point Security Gateway, Spark Firewall, or a Security Management Server, treat this as urgent rather than routine: confirm your LivePatch or Jumbo Hotfix version against the exact builds above, since an earlier patch may not be enough on its own. Then check Mobile Access logs against the certificate subjects Check Point published, and don't assume a clean scan today rules out compromise — CVE-2026-93616 was already being used against targets for two months before anyone outside the attackers knew it existed.

Sources

• Check Point: Security Advisory — Active Exploitation of CVE-2026-85102 and CVE-2026-93616
• BleepingComputer: Check Point warns of hackers exploiting Security Gateway VPN RCE flaw
• The Hacker News: Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE
• CISA: Known Exploited Vulnerabilities Catalog