Check Point confirms two pre-authentication flaws under active exploitation in Gateway and Management
On September 22, 2026, Check Point published an “Action Required” advisory confirming in-the-wild exploitation of two CVSS 9.8 vulnerabilities: CVE-2026-85102 in the Security Gateway VPN and the zero-day CVE-2026-93616 in the Management server. Apply the fixes immediately and hunt for anomalous Mobile Access logins.
September 22, 2026. Check Point publishes an “Action Required” security advisory. September 9, 2026. The fix for the first flaw already existed, with no evidence of exploitation at the time. September 12, 2026. Exploitation attempts begin against Spark appliances. Why it matters: both vulnerabilities, each rated CVSS 9.8, deliver unauthenticated remote code execution on the two most sensitive components of a Check Point estate — the VPN gateway and the Management server.
Two flaws, two entry points
The advisory bundles two distinct vulnerabilities, patched at the same time but discovered on different timelines. The first, CVE-2026-85102, is improper certificate validation during the Security Gateway VPN negotiation. The second, CVE-2026-93616, is a zero-day pre-authentication path traversal in the Management web service that lets an attacker execute a script from an arbitrary path and load an arbitrary Java class.
The common thread is the most worrying part: neither requires credentials. An attacker who reaches either interface gets arbitrary code, often with elevated privileges, without clearing any authentication step. In both cases the CVSS verdict is identical: 9.8, the practical ceiling for a remotely exploitable flaw.
CVE-2026-85102: a one-day that became mass exploitation
Check Point disclosed CVE-2026-85102 and shipped its fix on September 9, 2026. At that point the vendor had no evidence of exploitation. Three days later, on September 12, a wave of attempts targeted Spark customers worldwide.
The attempts originate from anonymization infrastructure — VPNs and proxies — and rely on certificates with recognizable subjects:
CN=vpn,OU=users,O=global
CN=vpn-user,OU=users,O=global
CN=vpnuser,OU=users,O=globalThe list is not exhaustive: other certificate subjects are likely already in use. Affected versions span Security Gateway and Spark firewalls (centrally or locally managed): R81 and R81.10 (both end-of-life), R81.10.X, R81.20, R82, R82.00.X, and R82.10. The fix is documented in sk1000117.
CVE-2026-93616: the Management zero-day
The second flaw is quieter and, in some respects, worse. CVE-2026-93616 is a pre-authentication path traversal in Check Point’s Management web service. It allows an attacker to execute a script from an arbitrary path and load an arbitrary Java class — which, in practice, amounts to full takeover of the server that orchestrates the estate’s security policies.
Check Point observed “a handful of pinpointed attacks” on July 23, 2026. Affected versions range from R82.20 back to the historical R80.x line (all end-of-life), through these Jumbo Hotfixes: R82.10 Take 44 or lower, R82 Take 126 or lower, R81.20 Take 166 or lower, and R81.10 Take 190 or lower. The vendor flags one decisive detail: LivePatch Take 28/29 does not address this flaw — a full update is required. The fix and indicators of compromise are detailed in sk1000171.
Why Management is the crown jewel
A compromised Management server is nothing like a compromised gateway. It pushes policy to every gateway in the estate, centralizes administrator credentials, and aggregates logs. If an attacker seizes it, they own the security policy: they can open any rule, disable protections, and pivot to every managed gateway.
That is exactly what makes CVE-2026-93616 so dangerous. A pre-auth RCE on that surface turns the machine meant to defend the network into the starting point of the intrusion. The golden rule, restated implicitly by the advisory, stands: the Management server must never be reachable from the Internet.
What the vendor recommends
The guidance breaks into three actions. Install the fixes immediately — the only measure that actually closes both holes. Inspect logs for anomalous certificate-based Mobile Access logins, without limiting the search to the subjects above. Hunt for second-stage activity: once inside, attackers often launch internal port and service scans to prepare lateral movement.
For teams running Spark estates, the risk is immediate: exploitation of CVE-2026-85102 is ongoing and automated. For those exposing a Management server, the question barely needs asking — the reflex is to cut the exposure before applying the patch.
A three-day window, once again
The CVE-2026-85102 timeline — patch on September 9, exploitation on September 12 — restates a trend that has become structural: the window between a patch’s release and its mass exploitation keeps shrinking. The vendor ships, the attacker weaponizes within days, sometimes less.
For a perimeter appliance, the only winning move is automation. Patch in hours, not weeks, and watch administration interfaces continuously for any sign of exploitation before it hardens into a confirmed compromise.
How to assess your exposure
The first step is not patching — it is knowing what you actually run. On a Check Point gateway or Management server, cpinfo -y all returns the product version and the installed Jumbo Hotfix Take. That Take number is what you compare against the vulnerable thresholds listed in the advisory.
# Product version + installed patch level
cpinfo -y all | grep -iE 'version|take|hotfix'
# List recent Mobile Access logins (hunting for CVE-2026-85102)
fw log -f | grep -iE 'mobile access|vpn|certificate'
# Check whether Management listens on a public interface (it should not)
netstat -tulpn | grep -E ':(443|80|18264)\b'An estate still running R81 or R81.10 — both end-of-life — stacks two risks at once: a known flaw and no upcoming official fix. For those versions, the answer is not a patch but a planned migration to a supported branch.
A reminder for perimeter teams
The two flaws share a lesson that goes beyond Check Point. CVE-2026-85102 is a pre-auth RCE on a VPN negotiation, the kind of exposure perimeter teams often deprioritize because the VPN has always “just worked.” CVE-2026-93616 is a pre-auth RCE on a management web service, the kind that hides because management interfaces are supposed to be internal.
Both are the same failure mode: a network-facing service that authenticates only after it has already accepted attacker-controlled input. When the vendor publishes a fix, the clock starts. Teams that treat the advisory as a routine patch note — and not as an incident trigger — are the ones who find the second-stage scans a week later.
Verdict
Check Point delivers a demonstration of a now-classic pattern: a published patch, a three-day lag, then automated exploitation against exposed gear. If you run Check Point gateways, especially Spark appliances, apply sk1000117 without delay and hunt for VPN logins with anomalous certificates. If you manage a Management server, apply sk1000171, confirm it is not publicly exposed, and treat any unauthorized access as an incident. Both flaws offer unauthenticated remote code execution: the cost of the patch is nowhere near the cost of a compromised gateway or Management server.