cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Check Point Confirms Active Exploitation of Two Security Gateway Flaws

· Original article ↗

Summary

Check Point confirmed active exploitation of two pre-authentication flaws affecting Security Gateway and Management web services. CISA added both to its KEV catalog; Check Point recommends updates or mitigations.

Key points

  • CVE-2026-85102 is a pre-authentication RCE flaw in Security Gateway VPN certificate handling.
  • CVE-2026-93616 is a pre-authentication path traversal flaw in the Management web service that can allow script execution and Java class loading; Check Point says it has been exploited as a zero-day since July 23.
  • Check Point observed exploitation attempts starting September 12, 2026, against Spark customers, using VPNs and proxies to conceal attackers’ locations.
  • Check Point observed certificates with subjects CN=vpn,OU=users,O=global and CN=vpn-user,OU=users,O=global, while warning that other subjects may also be in use.
  • CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog and set September 25, 2026, as the remediation deadline for federal agencies.
  • Check Point recommends specified LivePatch or hotfix releases for affected gateways and software updates for Spark firewalls; where updates are unavailable, it provides VPN access restrictions as mitigation for CVE-2026-85102.

Article Details

Vulnerability Types
  • Pre-authentication remote code execution
  • Pre-authentication path traversal
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • If updating is not possible, disable VPN implied rules and create explicit rules restricting Site-to-Site VPN on UDP/500 and UDP/4500 to specific peer IP addresses.
  • For Remote Access VPN, allow only required services over UDP/500, UDP/4500, TCP/443, and TCP/80 where applicable, and restrict source client IP ranges where possible. These measures do not apply to locally managed Spark firewalls.

CVE

CVE-2026-85102Check Point has confirmed active exploitation of CVE-2026-85102 and CVE-2026-93616, with attackers using VPNs and proxies to hide their origin while targeting Security Gateway and Management web service flaws.CVE-2026-93616Check Point has confirmed active exploitation of CVE-2026-85102 and CVE-2026-93616, with attackers using VPNs and proxies to hide their origin while targeting Security Gateway and Management web service flaws.

Vendors

Check PointCheck Point has confirmed active exploitation of CVE-2026-85102 and CVE-2026-93616, with attackers using VPNs and proxies to hide their origin while targeting Security Gateway and Management web service flaws.

Products

Security GatewayCheck Point has confirmed active exploitation of CVE-2026-85102 and CVE-2026-93616, with attackers using VPNs and proxies to hide their origin while targeting Security Gateway and Management web service flaws.Spark FirewallCheck Point issued patching and mitigation steps for affected gateways and Spark firewalls.

Related Articles