NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

Check Point gateways and management servers: CVE-2026-85102 and CVE-2026-93616 exploited; fixes available

Check Point says two critical, no-login flaws are being used in attacks: CVE-2026-85102 (VPN on gateways and Spark firewalls) and CVE-2026-93616 (management servers). Fixes exist for supported versions. Install them now and review VPN logs.

What to do

If you run Check Point gateways, Spark firewalls or management servers, or someone manages them for you, ask your IT provider to install the fixes in Check Point's notices sk1000117 and sk1000171 now. Nothing for home users to do unless you run these business products.

What’s happening

Check Point has confirmed attacks on two critical flaws, both rated 9.8. CVE-2026-85102 is an improper certificate check in the VPN of Security Gateways and Spark Firewalls that could let an attacker run code without logging in. Check Point released a fix on 9 September, and says attacks on Spark Firewalls began on 12 September. CVE-2026-93616 is a path traversal flaw in the web service of Security Management, Multi-Domain, Log Server and SmartEvent systems, letting an attacker upload and run scripts without logging in. Check Point says it saw a handful of targeted attacks from 23 July, before a fix existed, and published a fix with its 20 September advisory. CISA listed both flaws as exploited on 22 September. Fixes cover the supported versions through LivePatch or Jumbo Hotfix takes. Older end-of-support releases from R80 up to R81 are listed as affected for CVE-2026-93616, and no fixed build is named for them. Smart-1 Cloud already has its fix applied. Neither flaw has a known link to the other in the attacks.

What
Flaw
Affects
Check Point Security Gateway, Spark Firewall, Security Management, Multi-Domain, Log Server and SmartEvent
Affected
CVE-2026-85102: Security Gateway and Spark Firewall (locally and centrally managed) using Site-to-Site or Remote Access VPN: R81.20, R82, R82.10, R81.10.x, R82.00.x; end-of-support R80 through R81.10 (R82.20 not affected)
CVE-2026-93616: Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, SmartEvent: R82.20; R82.10 Jumbo Hotfix Take 44 or lower; R82 Take 126 or lower; R81.20 Take 166 or lower; R81.10 Take 190 or lower (end of support); R80 through R81 (all end of support)
Fixed in
CVE-2026-85102: LivePatch Take 26 (R82.10, R82, R81.20); Jumbo Hotfix R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+, R81.10 Take 190+; Spark R82.00.10 build 2325+, R81.10.17 build 4968+
CVE-2026-93616: R82.20 Security Hotfix (no reboot); Jumbo Hotfix R82.20 Take 10, R82.10 Take 45, R82 Take 127, R81.20 Take 170, R81.10 Take 192 or later; LivePatch does not fix it
CVE
CVE-2026-85102, CVE-2026-93616
Since
22 Sept 2026
Closed
13 Oct 2026

Timeline

  1. Vendor revised

    Check Point's advisory for CVE-2026-93616 was last modified. It says the flaw is exploited in the wild, a handful of customers were attacked, and LivePatch does not fix it.

  2. CISA added

    Check Point issued a joint security advisory urging immediate patching of both flaws, and CISA listed both as exploited in attacks.

  3. New fixFixed

    Check Point published its advisory for CVE-2026-93616, a pre-login flaw in Management servers, with a no-reboot security hotfix and Jumbo Hotfix takes that fix it.

  4. Vendor revised

    Check Point updated its advisory: customers on older offline LivePatch packages need LivePatch Take 26 for full coverage of CVE-2026-85102.

  5. Wider attacks

    Attack attempts against Spark Firewalls using CVE-2026-85102 began, coming from VPN services and proxies and using certificates with names such as CN=vpn.

  6. New fixFixed

    Check Point released a fix for CVE-2026-85102, the VPN certificate-validation flaw in Security Gateway and Spark Firewall.

  7. Update

    Check Point says it saw a handful of targeted attacks on its Management web service flaw (later CVE-2026-93616) as early as this date, before any fix existed.

Sources

  1. CVE-2026-85102: Authentication Bypass and Remote Code Execution in VPN (sk1000117)Check Point · 24 Sept 2026
  2. Check Point security advisory: active exploitation of CVE-2026-85102 and management pre-authentication vulnerability CVE-2026-93616Check Point · 22 Sept 2026
  3. CVE-2026-93616: path traversal and file upload in Management Server (sk1000171)Check Point · 13 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from September 2026 · JSON · RSS