{"id":"checkpoint-vpn-gateway-management-rce-sep-2026","category":"patch","status":"closed","title":"Check Point gateways and management servers: CVE-2026-85102 and CVE-2026-93616 exploited; fixes available","tldr":"Check Point says two critical, no-login flaws are being used in attacks: CVE-2026-85102 (VPN on gateways and Spark firewalls) and CVE-2026-93616 (management servers). Fixes exist for supported versions. Install them now and review VPN logs.","summary":"Check Point has confirmed attacks on two critical flaws, both rated 9.8. CVE-2026-85102 is an improper certificate check in the VPN of Security Gateways and Spark Firewalls that could let an attacker run code without logging in. Check Point released a fix on 9 September, and says attacks on Spark Firewalls began on 12 September. CVE-2026-93616 is a path traversal flaw in the web service of Security Management, Multi-Domain, Log Server and SmartEvent systems, letting an attacker upload and run scripts without logging in. Check Point says it saw a handful of targeted attacks from 23 July, before a fix existed, and published a fix with its 20 September advisory. CISA listed both flaws as exploited on 22 September. Fixes cover the supported versions through LivePatch or Jumbo Hotfix takes. Older end-of-support releases from R80 up to R81 are listed as affected for CVE-2026-93616, and no fixed build is named for them. Smart-1 Cloud already has its fix applied. Neither flaw has a known link to the other in the attacks.","action":"If you run Check Point gateways, Spark firewalls or management servers, or someone manages them for you, ask your IT provider to install the fixes in Check Point's notices sk1000117 and sk1000171 now. Nothing for home users to do unless you run these business products.","product":"Check Point Security Gateway, Spark Firewall, Security Management, Multi-Domain, Log Server and SmartEvent","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-85102","CVE-2026-93616"],"tags":["check-point","firewall","vpn","zero-day","cisa-kev","spark","management-server"],"affected":["CVE-2026-85102: Security Gateway and Spark Firewall (locally and centrally managed) using Site-to-Site or Remote Access VPN: R81.20, R82, R82.10, R81.10.x, R82.00.x; end-of-support R80 through R81.10 (R82.20 not affected)","CVE-2026-93616: Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, SmartEvent: R82.20; R82.10 Jumbo Hotfix Take 44 or lower; R82 Take 126 or lower; R81.20 Take 166 or lower; R81.10 Take 190 or lower (end of support); R80 through R81 (all end of support)"],"fixed":["CVE-2026-85102: LivePatch Take 26 (R82.10, R82, R81.20); Jumbo Hotfix R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+, R81.10 Take 190+; Spark R82.00.10 build 2325+, R81.10.17 build 4968+","CVE-2026-93616: R82.20 Security Hotfix (no reboot); Jumbo Hotfix R82.20 Take 10, R82.10 Take 45, R82 Take 127, R81.20 Take 170, R81.10 Take 192 or later; LivePatch does not fix it"],"matches":[],"sources":[{"kind":"advisory","title":"CVE-2026-85102: Authentication Bypass and Remote Code Execution in VPN (sk1000117)","url":"https://support.checkpoint.com/results/sk/sk1000117","by":"Check Point","date":"2026-09-24"},{"kind":"advisory","title":"Check Point security advisory: active exploitation of CVE-2026-85102 and management pre-authentication vulnerability CVE-2026-93616","url":"https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/","by":"Check Point","date":"2026-09-22"},{"kind":"advisory","title":"CVE-2026-93616: path traversal and file upload in Management Server (sk1000171)","url":"https://support.checkpoint.com/results/sk/sk1000171","by":"Check Point","date":"2026-10-13"}],"started":"2026-09-22","closed":"2026-10-13","created":"2026-11-03T22:07:39.370Z","updated":"2026-11-03T22:07:39.370Z","cve_notes":[{"cve":"CVE-2026-85102","name":"Certificate validation flaw in Check Point VPN","what":"Improper certificate validation during VPN negotiation on Security Gateways and Spark Firewalls that could let an unauthenticated attacker anywhere on the internet run their own code on the gateway.","severity":"critical","cvss":9.8},{"cve":"CVE-2026-93616","name":"Path traversal in Check Point Management web service","what":"A path traversal flaw in the web service of Check Point management, log and SmartEvent servers that lets an attacker with no login upload and run their own scripts on the server.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-10-13","added":"2026-11-03T22:05:27.736Z","kind":"vendor-revised","text":"Check Point's advisory for CVE-2026-93616 was last modified. It says the flaw is exploited in the wild, a handful of customers were attacked, and LivePatch does not fix it.","url":"https://support.checkpoint.com/results/sk/sk1000171","by":"Check Point","patch":null},{"at":"2026-09-22","added":"2026-11-03T22:05:27.736Z","kind":"cisa-added","text":"Check Point issued a joint security advisory urging immediate patching of both flaws, and CISA listed both as exploited in attacks.","url":"https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/","by":"Check Point","patch":null},{"at":"2026-09-20","added":"2026-11-03T22:05:27.736Z","kind":"new-fix","text":"Check Point published its advisory for CVE-2026-93616, a pre-login flaw in Management servers, with a no-reboot security hotfix and Jumbo Hotfix takes that fix it.","url":"https://support.checkpoint.com/results/sk/sk1000171","by":"Check Point","patch":"patched"},{"at":"2026-09-14","added":"2026-11-03T22:05:27.736Z","kind":"vendor-revised","text":"Check Point updated its advisory: customers on older offline LivePatch packages need LivePatch Take 26 for full coverage of CVE-2026-85102.","url":"https://support.checkpoint.com/results/sk/sk1000117","by":"Check Point","patch":null},{"at":"2026-09-12","added":"2026-11-03T22:05:27.736Z","kind":"wider-attacks","text":"Attack attempts against Spark Firewalls using CVE-2026-85102 began, coming from VPN services and proxies and using certificates with names such as CN=vpn.","url":"https://support.checkpoint.com/results/sk/sk1000117","by":"Check Point","patch":null},{"at":"2026-09-09","added":"2026-11-03T22:05:27.736Z","kind":"new-fix","text":"Check Point released a fix for CVE-2026-85102, the VPN certificate-validation flaw in Security Gateway and Spark Firewall.","url":"https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/","by":"Check Point","patch":"patched"},{"at":"2026-07-23","added":"2026-11-03T22:05:27.736Z","kind":"other","text":"Check Point says it saw a handful of targeted attacks on its Management web service flaw (later CVE-2026-93616) as early as this date, before any fix existed.","url":"https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/","by":"Check Point","patch":null}],"url":"https://hard.fyi/live/checkpoint-vpn-gateway-management-rce-sep-2026/","json":"https://hard.fyi/api/live?id=checkpoint-vpn-gateway-management-rce-sep-2026"}