Check Point confirms exploitation of a September VPN fix and discloses a zero-day in its management server

12 September 2026. Check Point observes the first exploitation attempts against CVE-2026-85102 targeting its Spark firewalls, three days after the patch shipped. 9.8. The CVSS score of both pre-authentication flaws detailed in the vendor’s mid-October “Action Required” advisory. 23 July 2026. The date of the first pinpointed attacks on CVE-2026-93616, a management-server zero-day only now fixed. Why it matters: a VPN flaw patched five weeks ago is being exploited at scale, and the new zero-day hits the appliance teams always patch last — the management server.

The VPN flaw: fixed, then exploited

CVE-2026-85102 is improper certificate-data validation (CWE-295) during VPN negotiation on Check Point Security Gateways. A remote, unauthenticated attacker can execute arbitrary code on the gateway. The flaw affects both Remote Access VPN and site-to-site VPN, and the products range from R81 to R82.10, including Spark firewalls (centrally and locally managed).

Check Point disclosed and fixed the flaw on 9 September 2026, in an emergency batch that also included CVE-2026-85103, a heap overflow in the ASN.1 certificate decoding path, also rated 9.8. At the time, the vendor said it had « no evidence of exploitation ». That caution didn’t hold.

On 12 September, Check Point observed a wave of exploitation attempts against Spark customers. The attempts came from anonymisation infrastructure — commercial VPNs and proxies — and presented certificates with predictable subjects: CN=vpn, CN=vpn-user, CN=vpnuser, all with OU=users, O=global. The attacker knocks on the VPN door with a malformed certificate whose validation fails in an exploitable way, without needing any account.

The management-server zero-day

CVE-2026-93616 is a different beast: a pre-authentication path traversal combined with a file upload in the Check Point management web service. It lets an attacker execute a script from an arbitrary path and load an arbitrary Java class — again, code execution with no credentials.

Check Point calls it a zero-day: a handful of pinpointed attacks were identified as early as 23 July 2026. It affects Security Management R82.20, R82.10 (Jumbo Hotfix Take 44 or lower), R82 (Take 126 or lower), R81.20 (Take 166 or lower), plus older end-of-support releases. The fix is only available now, alongside the “Action Required” advisory.

The point that matters: the management server is the appliance that controls every gateway in a fleet. An RCE there doesn’t drop one firewall — it hands over the entire security policy: rules, objects, certificates, admin accounts.

Why “fixed” doesn’t mean “protected”

The lesson of CVE-2026-85102 is a timeline: fix on 9 September, exploitation on 12 September, public confirmation in mid-October. The gap isn’t technological, it’s operational. The targeted Spark customers had a patch available for weeks and hadn’t applied it — a pattern familiar on perimeter appliances, where fear of breaking production VPN holds back the patch.

CVE-2026-93616 makes it worse by hitting the other end of the neglect spectrum. The management server is rarely exposed to the internet, which makes it look less urgent; yet it is the highest-yield target, since compromising it unlocks the whole fleet. Check Point notes that its LivePatch (Take 28/29) does not fix this zero-day — a trap for teams counting on hot-patching without a reboot.

What to do, in order

First, the management server. Apply the CVE-2026-93616 fix (SK sk1000171) first, then follow the hunting steps and indicators of compromise in the same SK to confirm no script has already been dropped. It’s the box whose compromise voids everything else.

Next, the gateways. If you skipped the 9 September patch, apply it now (SK sk1000117) and treat the gateways as potentially compromised, not merely as needing a patch. Check Point recommends reviewing logs for anomalous certificate-based Mobile Access logins — without limiting the search to the three known subjects — then hunting for second-stage activity: internal port and service scans from the logged-in accounts.

Finally, posture. The anonymisation infrastructure used complicates attribution, but the playbook — malformed certificate, then internal reconnaissance — is that of an actor preparing initial access for something else. Consider full remediation on exposed gateways, not just a reboot.

Verdict

If you run Check Point appliances, the urgency is double but ordered: apply the management-server fix (CVE-2026-93616) first, then the gateway fix (CVE-2026-85102) if you haven’t, and run the hunting in both cases. If you already applied the 9 September patch, you’re covered for the VPN flaw but still exposed to the management zero-day — a false sense of security is precisely the trap. And remember the timeline: between a patch’s release and its application there is a window attackers can measure in days, not weeks.

References

• Check Point Blog — Security Advisory, Action Required: CVE-2026-85102 and CVE-2026-93616
• Check Point — sk1000117: CVE-2026-85102
• Check Point — sk1000171: CVE-2026-93616
• CERT-EU — Security Advisory 2026-012, Critical Vulnerabilities in Check Point Products
• Truesec — CVE-2026-85102 & CVE-2026-93616: Active Exploitation