Check Point Reports Targeted Attacks on Management Server Zero-Day and Attempts Against VPN Flaw
Summary
Check Point says attackers used a management-server zero-day in limited attacks on July 23 and began trying to exploit a separate VPN flaw on September 12. Fixes and mitigation guidance are available for both.
Key points
- CVE-2026-93616 is a path traversal flaw in the Security Management Server web service that can allow unauthenticated script upload and execution by an attacker able to access the service.
- Check Point said CVE-2026-93616 was used in limited, targeted attacks on July 23; it did not identify the targets or attackers, or describe what happened after exploitation.
- Check Point released a fix for CVE-2026-93616 on September 22. Administrators should check affected versions and hotfix levels, install the fix, and use the vendor's hunting guidance; patching does not establish whether a server was previously attacked.
- CVE-2026-85102 affects certificate handling during VPN setup on Check Point gateways and Spark firewalls and may allow unauthenticated code execution.
- Check Point said attempts to exploit CVE-2026-85102 began on September 12, using anonymizing infrastructure and suspicious certificates; it did not say whether any attempt succeeded.
- Check Point says customers who installed the September 9 fix for CVE-2026-85102 are protected. Guidance includes checking logs and investigating suspicious Mobile Access users; a listed workaround for unpatched gateways does not apply to locally managed Spark firewalls.
Article Details
- Vulnerability Types
- Path traversal in the Security Management Server web service
- VPN certificate-handling flaw
- Severity
- CVE-2026-93616 was rated 9.8 out of 10 on the CVSS scale.
- Affected Versions
- Security Management Server R82.20 with no Jumbo Hotfix installed
- Security Management Server R82.10 with Jumbo Hotfix Take 44 or below
- Security Management Server R82 with Jumbo Hotfix Take 126 or below
- Security Management Server R81.20 with Jumbo Hotfix Take 166 or below
- Security Management Server R81.10 with Jumbo Hotfix Take 190 or below
- Security Management Server R81, R80.40, R80.30, R80.20, R80.10, and R80
- Security Gateway and Spark firewalls on R81, R81.10, R81.10.x, R81.20, R82, R82.00.x, and R82.10
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- For unpatched gateways using Site-to-Site VPN, turn off the implied VPN rules and allow UDP ports 500 and 4500 only from specific peer IP addresses. The article says this workaround does not apply to locally managed Spark firewalls.
MITRE ATT&CK
CVE
CVE-2026-85102Separately, attackers have been trying to exploit CVE-2026-85102 in Spark firewalls and gateways through VPN connections since September 12, using anonymizing infrastructure and suspicious certificates.CVE-2026-85103CVE-2026-85103, a VPN certificate flaw that Check Point fixed on September 9, affected both gateways and management servers.CVE-2026-91843On September 16, Check Point fixed a separate flaw in the management server, CVE-2026-91843, through LivePatch.CVE-2026-93616Check Point said attackers used a zero-day flaw, CVE-2026-93616, to target Security Management Servers in limited attacks on July 23, and the company later released fixes and hunting guidance.
Vendors
Products
Security GatewayThe affected products are Security Gateway and Spark firewalls, whether centrally or locally managed, on R81 and R81.10 (both end of support), R81.10.x, R81.20, R82, R82.00.x and R82.10.Security Management ServerCVE-2026-93616 is a path traversal flaw in Check Point Security Management Server web service.SparkSeparately, attackers have been trying to exploit CVE-2026-85102 in Spark firewalls and gateways through VPN connections since September 12, using anonymizing infrastructure and suspicious certificates.