Check Point confirms active exploitation of two VPN and management flaws

Check Point has confirmed active exploitation of two vulnerabilities in its Security Gateway and Security Management products, CVE-2026-85102 and CVE-2026-93616. CISA added both to its Known Exploited Vulnerabilities catalogue on 22 September, and fixes have been available since 9 September and 22 September respectively.^[1]^[2]

What we know

CVE-2026-85102 is a pre-authentication remote code execution flaw in the VPN certificate handling of Check Point Security Gateway, fixed since 9 September 2026. CVE-2026-93616 is a separate pre-authentication path traversal flaw in the Security Management web service, disclosed and fixed as a zero-day on 22 September.^[1] Check Point says exploitation attempts against Spark customers began on 12 September, using certificates issued to generic subjects such as CN=vpn,OU=users,O=global, and that CVE-2026-93616 saw a handful of pinpointed attacks starting 23 July.^[1] CISA added both CVEs to its KEV catalogue on 22 September with a 25 September remediation deadline for federal agencies.^[2]^[5]

What we don’t know

Neither Check Point nor CISA has published a count of compromised organisations, confirmed data accessed, or attacker identity. The Dutch NCSC’s 10 September alert warned that large-scale abuse of CVE-2026-85102 was likely soon, but did not claim exploitation had already happened; NCSC’s advisory was updated on 23 September specifically to note that Check Point had reported observed abuse, citing Check Point as the source of that finding rather than an independent NCSC observation.^[7] The certificate subjects Check Point lists are explicitly described as partial, so the true footprint of the campaign is not established.^[1]

Why it matters

Both flaws sit in front of authentication on infrastructure designed to be internet-facing, which is the combination that turns a CVSS 9.8 score into an immediate operational problem rather than a routine patch-cycle item. Unpatched, exposed gateways are now a known target, not a theoretical one.^[1]^[2]

Timeline infographic: Check Point CVE-2026-85102 (Security Gateway, pre-auth RCE, fixed 9 Sep 2026) and CVE-2026-93616 (Security Management, pre-auth path traversal zero-day, fixed 22 Sep 2026), both CVSS 9.8. Timeline shows 23 Jul first pinpointed CVE-93616 attacks (reported later), 9 Sep CVE-85102 disclosed and fixed, 10 Sep NCSC alert warns of high risk and abuse expected soon (not yet confirmed), 12 Sep Check Point’s own account places the exploitation wave’s start, 22 Sep CVE-93616 zero-day fixed and both added to CISA KEV, 25 Sep KEV remediation deadline for US federal agencies. A callout notes that NCSC’s 10 Sep alert warned of imminent abuse, not confirmed exploitation, and that its 23 Sep update citing observed abuse restates Check Point’s own report. The graphic does not quantify victims or confirm compromise. — Reported disclosure and exploitation timeline. Spacing is not proportional to elapsed time. NCSC’s 10 September alert warned abuse was likely soon; its 23 September update crediting observed abuse to Check Point’s own report is not an independent NCSC finding.

Two flaws, two different disclosure clocks

CVE-2026-85102 and CVE-2026-93616 did not arrive on the same schedule, and the gap between them is part of the story. Check Point disclosed CVE-2026-85102, a pre-authentication remote code execution vulnerability in how Security Gateway validates certificate data during VPN negotiation, on 9 September, alongside a fix. The company initially reported no evidence of exploitation.^[1] CVE-2026-93616 is different in kind: a pre-authentication path traversal vulnerability in the Security Management web service that lets an attacker execute a script from an arbitrary path and load an arbitrary Java class, which Check Point calls a zero-day because exploitation preceded any public fix.^[1]

Both carry a CVSS score of 9.8. CVE-2026-85102 affects Security Gateway and both centrally and locally managed Spark Firewall deployments running R81 and R81.10 (both end-of-support), R81.10.X, R81.20, R82, R82.00.X and R82.10. CVE-2026-93616 affects Security Management running R82.20 or earlier Jumbo Hotfix takes, plus the fully end-of-support R80.x and R81 lines.^[1] Fixed builds exist for every affected branch: Check Point directs Security Gateway customers to LivePatch Take 26 or a Jumbo Hotfix at R81.20 Take 166, R82 Take 126, R82.10 Take 44 or R81.10 Take 190 or later, and Spark customers to R82.00.10 Build 2325 or R81.10.17 Build 4968 or later.^[1]^[3]

What Check Point says it observed

Check Point’s own account dates the CVE-2026-85102 exploitation wave to 12 September: a burst of attempts against Spark customers originating from anonymisation infrastructure, including VPN services and proxies, using certificates with subjects such as CN=vpn,OU=users,O=global, CN=vpn-user,OU=users,O=global and CN=vpnuser,OU=users,O=global. The company is explicit that this list reflects only what it has observed so far and is not exhaustive.^[1] For CVE-2026-93616, Check Point describes “a handful of pinpointed exploitation” attempts starting 23 July, roughly nine weeks before the flaw had a public advisory or a name.^[1]

The Dutch Nationaal Cyber Security Centrum published an alert on 10 September covering CVE-2026-85102 and a related heap-overflow flaw, CVE-2026-85103, in the VPN certificate ASN.1 decoder. That original alert said NCSC expected large-scale abuse attempts “in the short term”; BleepingComputer’s report on the alert, published two days later on 12 September, quoted NCSC using the same “imminent” framing and stated explicitly that no public proof-of-concept had been reported.^[4] NCSC’s advisory carries a machine-readable revision history: version 1.0.0, timestamped 10 September, contains only that expectation-of-abuse language, and version 1.0.1, timestamped 23 September, adds a single new line stating that Check Point had reported observed abuse of CVE-2026-85102, attributing that finding to Check Point by name.^[7] Read against that revision history, the two accounts are sequential rather than contradictory: NCSC warned abuse was likely on 10 September, Check Point says its own telemetry first caught the wave on 12 September, and NCSC’s 23 September update folded Check Point’s report into its advisory without claiming an independent observation of its own.

Why the KEV listing raises the stakes

CISA’s Known Exploited Vulnerabilities catalogue exists to flag vulnerabilities it has evidence are being exploited, and it added both CVE-2026-85102 and CVE-2026-93616 on 22 September, alongside unrelated flaws in Arista VeloCloud Orchestrator and F5 BIG-IP APM.^[2] The KEV entries carry a 25 September remediation deadline, binding on US Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04, though CISA also encourages every organisation to treat KEV membership as a prioritisation signal regardless of sector.^[2]^[5]

A KEV listing is a statement that CISA has evidence of exploitation somewhere, not a measurement of how many organisations were affected or how successful any given attempt was. It changes the operational calculus for defenders by removing the option of treating the patch as routine maintenance, but it does not, on its own, establish scale.^[2]

Mitigation beyond patching

For organisations that cannot immediately apply the fixed builds, Check Point and NCSC converge on the same fallback for CVE-2026-85102: disable the VPN implied rules and replace them with explicit rules restricting Site-to-Site VPN to specific peer IP addresses over UDP/500 and UDP/4500, and for Remote Access VPN, limit exposure to the required services and restrict source IP ranges where feasible.^[3]^[6]

Check Point notes this mitigation path does not apply to locally managed Spark firewalls, which need the version update directly.^[3] For CVE-2026-93616, Check Point’s guidance is narrower: install the available fix, since the path traversal sits in the management plane rather than a component with an equivalent network-rule workaround.^[1]

Administrators reviewing logs for CVE-2026-85102 should not limit their search to the three certificate subjects Check Point published, since the company has said explicitly that other subjects may be in use, and should also look for second-stage activity from Mobile Access logins, such as internal port and service scanning that would follow a successful initial compromise.^[1]

What still needs an answer

The public record leaves one open question rather than the chronology conflict it might first appear to be. Neither Check Point nor CISA has disclosed how many Security Gateway or Security Management instances were successfully compromised, as distinct from how many saw exploitation attempts; the certificate-subject list and the “handful of pinpointed” language both describe what was detected, not the full extent of what happened.^[1]^[2] Separately, NCSC’s original 10 September alert said no public proof-of-concept was known for either flaw at that point, and no source reviewed for this article has since reported one; that absence does not rule out a private or undisclosed PoC, only a public one.^[4]