Check Point Pre-Auth Flaws Under Attack

Check Point has warned that two critical, pre-authentication vulnerabilities affecting its security products are being actively exploited.

CVE-2026-85102 affects VPN certificate handling in Security Gateways and Spark Firewalls, while CVE-2026-93616 affects the Check Point Management web service. Both carry vendor-assigned CVSS 3.1 scores of 9.8, and CISA added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.

Check Point has released fixes and urged customers running affected products to install them immediately.

What Are CVE-2026-85102 and CVE-2026-93616?

CVE-2026-85102 is an improper certificate validation vulnerability in the VPN negotiation process. An unauthenticated remote attacker can exploit the flaw to execute arbitrary code on a vulnerable Security Gateway.

The vulnerability is classified as CWE-295: Improper Certificate Validation. Because exploitation occurs before authentication, an attacker does not need valid credentials or user interaction.

CVE-2026-93616 is a pre-authentication path traversal vulnerability in the Check Point Management web service. It can allow an unauthenticated attacker to execute a script from an arbitrary path and load an arbitrary Java class.

Both vulnerabilities have a CVSS score of 9.8, with network-based attack vectors, low complexity, no required privileges, and no user interaction. Check Point provides further technical and exploitation details in its security advisory.

Which Check Point Versions Are Affected?

CVE-2026-85102 affects Security Gateway and centrally or locally managed Spark Firewall deployments across affected R81 and R82 release branches. Check Point released the original fix on September 9.

Administrators should verify the exact installed build and Jumbo Hotfix Take rather than relying only on the major release number. Check Point maintains build-specific remediation requirements in its support guidance.

CVE-2026-93616 affects Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent across affected R80, R81, and R82 releases.

Check Point lists the following fixed releases for CVE-2026-93616:

Older R80 through R81 releases identified by Check Point are end-of-support and should be migrated to supported versions.

Check Point also warns that LivePatch Takes 28 and 29 do not address CVE-2026-93616. Administrators should consult Check Point’s CVE-2026-93616 support advisory for the latest affected builds, fixes, and mitigation instructions.

How Do These Check Point Vulnerabilities Work?

CVE-2026-85102 affects certificate processing during VPN negotiation. Improper validation of certificate data can allow an unauthenticated attacker to reach the vulnerable VPN service and execute arbitrary code on the gateway.

Because the flaw affects a network security boundary, successful exploitation could give an attacker an initial foothold on infrastructure responsible for controlling access to other network resources.

CVE-2026-93616 instead targets the Management web service. The path traversal weakness can allow an attacker to escape the intended file location and ultimately execute scripts from arbitrary paths or load arbitrary Java classes.

Compromise of a Management Server can be particularly significant because these systems manage security policies and other administrative functions. The ultimate impact depends on the deployment, connectivity, permissions, and subsequent attacker activity.

Are CVE-2026-85102 and CVE-2026-93616 Being Exploited?

Yes. Check Point has confirmed exploitation activity involving both vulnerabilities.

Check Point originally released fixes for CVE-2026-85102 on September 9, 2026, when it had no evidence of exploitation. Beginning September 12, however, the company observed a wave of exploitation attempts targeting Spark customers globally.

The activity originated from anonymization infrastructure, including VPN and proxy services. Check Point observed certificates containing subjects such as CN=vpn, CN=vpn-user, and CN=vpnuser, but cautioned that defenders should not treat those values as an exhaustive list.

For CVE-2026-93616, Check Point reported a handful of targeted attacks observed on July 23, 2026, meaning exploitation occurred before the vulnerability was publicly disclosed. CISA added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on September 22, setting a remediation due date of September 25, 2026 for federal agencies.

Track Check Point Exposure with SOCRadar

With both vulnerabilities already exploited in the wild, organizations need to identify affected systems quickly rather than prioritizing solely by severity scores.

SOCRadar’s Attack Surface Management (ASM) module can help identify internet-facing infrastructure, while Cyber Threat Intelligence (CTI) module provides visibility into vulnerability status, exploitation activity, and emerging public exploit information. Combining vulnerability intelligence with external asset visibility can help teams identify exposed systems and prioritize remediation as new exploitation details emerge.

What Should Defenders Do?

Apply Check Point’s Fixes

Inventory affected Security Gateways, Spark Firewalls, Management Servers, Log Servers, Multi-Domain systems, and SmartEvent deployments.

Apply the appropriate Check Point fixes and verify the release, Jumbo Hotfix Take, and build after installation. End-of-support installations should be prioritized for migration to supported releases.

For CVE-2026-93616, Check Point’s support advisory provides the current hotfix and upgrade requirements for each affected release.

Reduce Exposure

Where immediate patching is not possible, restrict affected services to trusted network paths.

For CVE-2026-93616, Check Point recommends restricting TCP/19009 to trusted IP addresses and reviewing Trusted Client settings so they contain only approved addresses. These controls should be treated as temporary risk reduction rather than substitutes for patching.

Do not assume that LivePatch Takes 28 or 29 protect systems against CVE-2026-93616.

Hunt for CVE-2026-85102 Activity

Review logs for anomalous certificate-based Mobile Access logins, suspicious authenticated sessions, and follow-on internal scanning after questionable VPN activity.

Check Point’s security advisory notes observed certificate subjects including CN=vpn, CN=vpn-user, and CN=vpnuser, but defenders should search beyond these values because they are not exhaustive indicators.

Hunt for CVE-2026-93616 Activity

Review affected Management infrastructure for indicators associated with exploitation. Check cpm.elg for unusually long usernames, including login attempts with usernames exceeding 1,000 characters.

Investigate related FWM or MDS core dumps, ReflectionUtils errors involving resource-map loading, and suspicious file paths containing traversal sequences. Check Point provides additional investigation guidance and indicators in its CVE-2026-93616 support advisory.

Preserve relevant logs and investigate unexpected administrative, policy, VPN, or system-integrity changes around suspected activity. Systems that were exposed before fixes were applied should be investigated for signs of compromise rather than assumed safe after patching.