Check Point has issued an urgent security advisory warning that attackers are actively exploiting two critical vulnerabilities affecting its VPN gateway and security-management products.
The flaws, tracked as CVE-2026-85102 and CVE-2026-93616, both carry a CVSS severity score of 9.8 and enable unauthenticated attackers to gain code-execution capabilities in exposed environments.
CVE-2026-85102 affects Check Point Security Gateway and Spark Firewall deployments using Remote Access VPN or certificate-based Site-to-Site VPN.
Critical Check Point VPN and Management Vulnerabilities
The vulnerability stems from improper validation of certificate data during VPN negotiation, potentially allowing a remote unauthenticated attacker to execute arbitrary code on a vulnerable gateway.
Check Point released patches for the issue on September 9, 2026, initially reporting no evidence of exploitation. However, the company later detected exploitation attempts beginning September 12 against Spark Firewall customers worldwide.
The activity originated through anonymization infrastructure, including VPN services and proxy networks, making source attribution and network-based blocking more difficult.
Observed attacks used suspicious certificate subjects including CN=vpn,OU=users,O=global, CN=vpn-user,OU=users,O=global, and CN=vpnuser,OU=users,O=global.
Check Point cautioned that these indicators are not comprehensive and defenders should investigate anomalous certificate-based Mobile Access logins more broadly.
Organizations should also look for post-compromise activity from newly authenticated VPN users, particularly internal port and service scans that may indicate reconnaissance following gateway access.
The second issue, CVE-2026-93616, is a zero-day vulnerability in Check Point Security Management infrastructure. It affects Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent installations.
Check Point said it is aware of a handful of customer attacks exploiting the flaw in the wild. The vulnerability is a pre-authentication directory-traversal and file-upload issue in the management web service.
Successful exploitation may allow an unauthenticated attacker to upload and execute arbitrary scripts on a management server.
Because management systems centrally administer firewall policies, gateways, logs, and security configurations, compromise could give an intruder a powerful foothold across an enterprise security environment.
Affected management releases include R82.20 and older hotfix levels across R82.10, R82, R81.20, and R81.10, as well as several end-of-support versions.
Check Point noted that LivePatch Take 28 and Take 29 do not remediate CVE-2026-93616; administrators must deploy the dedicated security hotfix or update to the corrected Jumbo Hotfix Accumulator versions.
The fix is included in Take 45 for R82.10, Take 127 for R82, Take 170 for R81.20, and Take 192 for R81.10. For CVE-2026-85102, Check Point recommends applying LivePatch Take 26 where applicable or installing updated Jumbo Hotfix Accumulators.
The company lists R82.20 as not affected by the VPN flaw and identifies updated Spark Firewall builds as remediated. Administrators should treat both vulnerabilities as urgent patching priorities.
In addition to installing fixes, organizations should restrict TCP/19009 access to management servers to trusted IP addresses, review Check Point logs for exploit indicators, investigate unexpected core dumps and directory-traversal paths, and isolate potentially compromised systems for incident-response analysis.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
