On 22 September 2026 Check Point published an "action required" advisory covering two exploited vulnerabilities, and CISA added both to the Known Exploited Vulnerabilities catalog the same day with a federal due date of 25 September. Both score 9.8 and neither needs credentials.
CVE-2026-85102 is a remote code execution bug in Security Gateway VPN certificate handling. It was fixed on 9 September, and Check Point says exploitation attempts against Spark firewalls started on 12 September. CVE-2026-93616 is a new zero-day in the Security Management web service. Check Point says it saw "a handful of pinpointed attacks" using it on 23 July 2026, two months before a fix existed.
What's affected
CVE-2026-93616 (sk1000171), management plane. A directory traversal and file upload flaw that lets an unauthenticated attacker upload and run arbitrary scripts and load an arbitrary Java class. Affected products are Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent. Smart-1 Cloud is already fixed. Firewall appliances and Spark firewalls are not affected.
| Version | Vulnerable | Fixed in |
|---|---|---|
| R82.20 | all | Security Hotfix (TAR, no reboot), or Jumbo Take 10 and later |
| R82.10 | Jumbo Take 44 or lower | Jumbo Take 45 |
| R82 | Jumbo Take 126 or lower | Jumbo Take 127 |
| R81.20 | Jumbo Take 166 or lower | Jumbo Take 170 |
| R81.10 (EoS) | Jumbo Take 190 or lower | Jumbo Take 192 |
R80 through R81 are end of support and affected. Check Point notes that LivePatch Take 28/29 does not address this issue and that no LivePatch is available for it.
CVE-2026-85102 (sk1000117), gateways. Improper certificate validation during VPN negotiation. Remote Access VPN is affected. Site to Site VPN is affected when certificate-based authentication is used or allowed; communities using only pre-shared keys are not. Affected versions are R81.20, R82, R82.10, R81.10.x and R82.00.x, plus the end of support R80 to R81.10 releases. R82.20 is not affected.
Fixes are either LivePatch bundle BUNDLE_URGENT_SECURITY_UPDATE_*_AUTOUPDATE Take 26 for R82.10, R82 and R81.20, or Jumbo Hotfix R82.10 Take 44, R82 Take 126, R81.20 Take 166, R81.10 Take 190 or later. Spark needs R82.00.10 Build 2325 or R81.10.17 Build 4968 or later.
How to check if you're exposed
Gateways (CVE-2026-85102). From Expert mode, confirm the LivePatch or bundle is in place:
cpinfo -y CPupdates # expect the AUTOUPDATE bundle at Take 26
cplp list # gateway or ClusterXL member
g_all cplp list # Scalable Platform security group
Check Point says the output should list CVE-2026-85102 and CVE-2026-85103 for the cpcert, cpcert:iked, cpcert:vpn, cpcert:vpnrad and cpcert_cprid components.
Then hunt in Logs and Monitor for events after 12 September with this query:
product: "Mobile Access" AND action: "Log In" AND "Certificate"
Look for logins from users, clients or source IPs you do not recognize. Check Point lists three certificate subjects seen in attacks, and stresses the list is not exhaustive: CN=vpn,OU=users,O=global, CN=vpn-user,OU=users,O=global and CN=vpnuser,OU=users,O=global. Follow any suspicious login forward. Check Point says second stage activity often includes internal port and service scanning.
Management servers (CVE-2026-93616). Run these from Expert mode on every Management, Multi-Domain, Log and SmartEvent server. The first looks for an authentication bypass attempt, a login with a username over 1,000 characters:
grep -nHP "login\(loginRequest=LoginRequest\{authenticationInfo=AuthenticationInfoBase\{username='[^']{1001,}'" "$MDS_FWDIR"/log/cpm.elg*
ls -l /var/log/dump/usermode/ | grep -e fwm -e mds
A core dump for FWM or MDS created at the same time as such a login is a sign of an exploitation attempt. The next three look for post-authentication traversal, upload and JAR path abuse:
grep -aE 'Invoking method .* in version: .*(\.|/|%2f|%2e|\\|%5c|CPupgrade-tools-\.\.)' "$MDS_FWDIR"/log/cpm.elg*
grep -aE 'Uploading file .*((\.\./)+|%2e%2e%2f|%2f).*(CPupgrade-tools-|scripts/check_upgrade_tools\.s(h)?)' "$MDS_FWDIR"/log/cpm.elg*
grep -aE 'The path to the jars: .*CPupgrade-tools-.*(\.\./|/\./|//|/temp/|/opt/CPsuite-)' "$MDS_FWDIR"/log/cpm.elg*
Check Point treats a match as something to investigate, not proof of compromise.
What to do now
- Patch management servers first. Install the Jumbo Hotfix take listed above, or the R82.20 Security Hotfix. Do not rely on LivePatch for CVE-2026-93616.
- Patch every gateway and Spark device running VPN with LivePatch Take 26 or the listed Jumbo take. If you installed the offline LivePatch package in September, Check Point's 14 September update says R82.10 Take 24 or lower, R82 Take 107 or lower and R81.20 Take 146 or lower need Take 26 specifically.
- Restrict access to management servers. Check Point's mitigation is to allow TCP port 19009 only from trusted IP addresses and to limit Trusted Clients under Manage and Settings, Permissions and Administrators.
- If a gateway cannot be patched yet, disable the VPN implied rules and write explicit rules for UDP 500, UDP 4500 and TCP 443 limited to known peers or client ranges. Test first, since rule changes can drop connectivity.
- Because CVE-2026-93616 was used in July, run the management hunts across logs back to at least that month.
Why it matters
The management server is where firewall policy is written. An attacker who runs code there can change what every managed gateway allows. That is why a zero-day used against "a handful" of targets in July is more serious than the count suggests: it was aimed, not sprayed.
The gateway bug shows the other pattern. CVE-2026-85102 had no known exploitation when it was fixed on 9 September, and attempts began three days later. A fix that sits uninstalled for a week on an internet-facing VPN is an open window.
Try it yourself
List every Check Point management and log server you run, including SmartEvent and any old R81.10 box nobody owns anymore. For each, record the Jumbo take and who can reach TCP 19009. Anything below the fixed take or reachable from outside your admin network is your first ticket. Then see how to choose between patching, mitigating and accepting risk in this demo:
Click through it at your own pace, or open it full screen.
Quick check
Does LivePatch fix CVE-2026-93616?
No. Check Point says LivePatch Take 28/29 does not address it and that no LivePatch is available. You need the Jumbo Hotfix take or the R82.20 Security Hotfix.
Are Site to Site VPNs using only pre-shared keys affected by CVE-2026-85102?
No. Check Point says gateways in communities that use only pre-shared keys are not affected. Remote Access VPN is affected.
When was CVE-2026-93616 first used?
Check Point says it observed pinpointed attacks on 23 July 2026. The fix and the KEV listing both came on 22 September.
Sources
- Check Point Blog: Active exploitation of CVE-2026-85102 and CVE-2026-93616
- Check Point sk1000171: CVE-2026-93616
- Check Point sk1000117: CVE-2026-85102
- CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog (22 September 2026)
- CISA Known Exploited Vulnerabilities Catalog
- NVD: CVE-2026-93616
- NVD: CVE-2026-85102
