Skip to content
HACKTECH
Exploited vulnerabilitiesReported Published 6 sources

Check Point confirms exploitation of VPN flaw CVE-2026-85102 and management zero-day

Check Point said on 22 September 2026 that attackers were exploiting two flaws rated CVSS 9.8. The first, CVE-2026-85102, is a pre-authentication remote code execution flaw in Security Gateway VPN certificate handling. It was disclosed and fixed on 9 September, and Check Point saw exploitation attempts against Spark customers from 12 September. The second, CVE-2026-93616, is a pre-authentication path traversal in the management web service, which Check Point said was used in a handful of pinpointed attacks on 23 July 2026, before a fix existed. CISA added both to its Known Exploited Vulnerabilities catalogue the same day.

  • Israel
  • Check Point
  • VPN
  • zero-days
  • CISA KEV
  • edge devices

What the sources report

  • CVE-2026-85102 (CVSS 9.8): improper validation of certificate data during VPN negotiation may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway. Affected products are Security Gateway and Spark firewalls using Site-to-Site or Remote Access VPN. For Site-to-Site VPN only gateways that use or allow certificate-based authentication are affected; gateways that participate only in pre-shared-key communities are not vulnerable (sk1000117).
  • Check Point disclosed and fixed CVE-2026-85102 on 9 September 2026, and The Hacker News reported the next day that the company had no indication it had been used in an attack. Check Point later said that from 12 September it saw exploitation attempts against Spark customers originating from anonymisation infrastructure, including VPN services and proxies, using certificate subjects such as CN=vpn,OU=users,O=global (Check Point blog; BleepingComputer).
  • CVE-2026-93616 (CVSS 9.8) is a directory traversal and file upload flaw that allows an unauthenticated attacker to upload and execute arbitrary scripts on the Check Point Management Server. Check Point says it is aware of a handful of customers who have been attacked (sk1000171).
  • CVE-2026-93616 affects Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent. Check Point says LivePatch Take 28/29 does not address it, and advises making port TCP/19009 reachable only from trusted IP addresses (sk1000171).
  • CISA added both CVEs to its Known Exploited Vulnerabilities catalogue on 22 September 2026 with a federal due date of 25 September 2026 (CISA KEV data; BleepingComputer).
  • Earlier in 2026 CISA added CVE-2026-50751, an authentication bypass in Remote Access VPN and Mobile Access certificate validation, to KEV on 8 June, and CVE-2026-16232, a SmartConsole authentication bypass, on 22 July. The Hacker News says Check Point described both as already exploited when it announced them.

What it means for your organisation

Exploitation attempts against CVE-2026-85102 started on 12 September, three days after the 9 September fix, so a patch cycle of several weeks for internet-facing devices leaves that gap open. CVE-2026-93616 was exploited before any fix existed, so the control that mattered was limiting who could reach management interfaces.

What we check

  • Check the installed Jumbo Hotfix or LivePatch take on every gateway and management server against sk1000117 and sk1000171, and flag any end-of-support versions.
  • Review Mobile Access logs from 12 September 2026 onward for certificate-based logins from unknown users, clients or source IPs, and for internal port scanning that followed.
  • Confirm that management, log and SmartEvent servers, including TCP/19009, can be reached only from trusted internal addresses.
  • Run the indicator-of-compromise checks in sk1000171 on management servers, and preserve evidence before remediating if anything matches.

Sources

Services that cover these checks

  • Network & infrastructure testing

    Internal and external network testing, including Active Directory. Where scope allows we go from an unauthenticated foothold to domain-wide impact and document the whole chain: the exposed service or sprayed credential that got us in, each privilege escalation on the way, and the accounts and hosts it reached.

    Duration: 5 to 12 working days

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works