Check Point Patches Two Critical Zero-Days Exploited in the Wild

Executive Summary

On September 22, 2026, Check Point disclosed two critical zero-day vulnerabilities that are under active exploitation. The first vulnerability, CVE-2026-93616, is a CVSS 9.8 path traversal flaw in multiple Check Point management server products. The second, CVE-2026-85102, is a CVSS 9.8 authentication bypass and remote code execution (RCE) vulnerability in Quantum Security Gateway and Spark firewalls. Due to confirmed in-the-wild attacks, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to apply patches promptly. Check Point has confirmed a "handful of customers" were targeted using CVE-2026-93616, with some attacks dating back to July 2026. A global wave of exploitation attempts against CVE-2026-85102 began around September 12, 2026.

Vulnerability Details

CVE-2026-93616: Management Server Path Traversal

This vulnerability is a pre-authentication path traversal flaw within the web service of affected management servers. An unauthenticated, remote attacker can exploit this by sending a specially crafted request to the server. The service fails to properly sanitize the path, allowing the attacker to access, upload, and execute arbitrary scripts on the server, leading to RCE with high privileges. The attack vector is the management interface, specifically TCP port 19009.

CVE-2026-85102: VPN Gateway Authentication Bypass & RCE

This vulnerability resides in the VPN component of Quantum Security Gateways and Spark firewalls. It stems from an improper validation of certificate data during the VPN negotiation process. An unauthenticated attacker can leverage this flaw to bypass authentication, gain unauthorized access to the gateway, and execute arbitrary code. Exploitation attempts have been observed originating from anonymized infrastructure like VPNs and proxies, indicating a broad and opportunistic attack campaign.

Affected Systems

• CVE-2026-93616 affects the following products:

  • Check Point Security Management Server (R82.20, R82.10, R82, R81.20, R81.10)
  • Check Point Multi-Domain Security Management Server
  • Check Point Log Server & Multi-Domain Log Server
  • Check Point SmartEvent

• CVE-2026-85102 affects the following products:

  • Check Point Quantum Security Gateway (R81, R81.10, R81.10.x, R81.20, R82, R82.00.x, R82.10)
  • Check Point Spark firewalls (commonly used by SMBs)

Exploitation Status

Both vulnerabilities are confirmed to be actively exploited in the wild. CISA added both CVE-2026-93616 and CVE-2026-85102 to its KEV Catalog on September 22, 2026. Check Point reported that attacks targeting CVE-2026-93616 began as early as July 23, 2026, suggesting some threat actors had access to the exploit for months. Widespread exploitation of CVE-2026-85102 against Spark firewall customers was observed starting September 12, 2026.

The active exploitation of these vulnerabilities, particularly the management server flaw which grants deep network access, poses a critical risk to organizations. Compromise of a security management server can lead to the complete takeover of an organization's security infrastructure.

Cyber Observables — Hunting Hints

The following patterns could indicate related activity:

Detection & Response

Security teams should prioritize investigating any anomalous activity related to Check Point management and VPN infrastructure.

1. Log Analysis: Ingest and analyze logs from Check Point devices. For CVE-2026-93616, focus on web service access logs on port 19009. Look for requests from untrusted IP addresses or patterns indicative of path traversal (../). For CVE-2026-85102, scrutinize VPN authentication logs for unusual patterns, such as a high volume of failed logins followed by a success from an unknown source, or connections with malformed certificate data. This corresponds to D3FEND techniques like Network Traffic Analysis.

2. Endpoint Detection: On the management server itself, monitor for the creation of unexpected files, particularly web shells or scripts in web-accessible directories. Track for suspicious child processes spawned by the management web service process. This aligns with File Analysis and Process Analysis.

3. Network Monitoring: Monitor all network traffic to and from the management server's interface. Any connections originating from external, non-whitelisted IPs should be treated as highly suspicious. Establish a baseline of normal traffic patterns and alert on deviations.

Mitigation

The most effective mitigation is to apply the security updates provided by Check Point immediately.

• For CVE-2026-93616: Install the R82.20 Security Hotfix or the latest Jumbo Hotfix Accumulator for your respective product version. This is a form of Software Update.
• For CVE-2026-85102: Install the hotfix released on September 9, 2026.

If patching is not immediately possible, apply the following compensating controls:

1. Restrict Access (CVE-2026-93616): Implement strict network access control lists (ACLs) to limit access to the management server's web interface (TCP port 19009) to only a small set of trusted IP addresses, such as dedicated management jump boxes. This is a core principle of Network Isolation.

2. Network Segmentation: Ensure management interfaces are not exposed to the internet and are on a segregated network segment, isolated from general user traffic. This aligns with the D3FEND countermeasure of Broadcast Domain Isolation.