--- url: "https://www.xcademia.com/news/check-point-warns-of-active-exploitation-of-two-critical-vulnerabilities" title: Check Point Warns of Active Exploitation of Two Critical Vulnerabilities description: "Check Point warns of active exploitation of CVE-2026-85102 and CVE-2026-93616. Learn about affected systems, risks and available fixes." publishedAt: "2026-09-23T11:05:06.49+00:00" updatedAt: "2026-09-23T12:09:58.220347+00:00" type: news category: cybersecurity source_name: Check Point Blog source_url: "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616 " tags: - "#CheckPoint" - "#Cybersecurity" - "#CVE2026" - "#ZeroDay" - "#Vulnerability" - "#NetworkSecurity" - "#VPNSecurity" - "#SecurityManagement" --- # Check Point Warns of Active Exploitation of Two Critical Vulnerabilities > Check Point has warned of active exploitation involving two critical vulnerabilities, CVE-2026-85102 and CVE-2026-93616, affecting Security Gateway and Security Management products. Source: **Check Point Blog** · 23 September 2026 ## CVE-2026-85102: VPN Certificate Handling Vulnerability CVE-2026-85102 is a **pre-authentication remote code execution vulnerability** involving certificate handling during VPN negotiation. According to Check Point, improper validation of certificate data during VPN negotiation can allow an unauthenticated remote attacker to execute arbitrary code. The vulnerability affects Security Gateway and Check Point Spark Firewall deployments in several configurations. Check Point disclosed the vulnerability and released a fix on **September 9, 2026**. At that time, the company said it had no evidence that the vulnerability was being exploited. That situation has since changed. Check Point says it began observing a wave of exploitation attempts against Spark customers globally starting **September 12, 2026**. The observed attempts originated from anonymization infrastructure, including VPN services and proxies. The company also identified several certificate subjects associated with the observed activity: - `CN=vpn,OU=users,O=global` - `CN=vpn-user,OU=users,O=global` - `CN=vpnuser,OU=users,O=global` Check Point specifically warns that this list is **not exhaustive**, meaning defenders should not rely only on these certificate subjects when investigating their environments. ## What organizations should check Check Point recommends reviewing logs for unusual certificate-based Mobile Access logins. Security teams should also investigate activity originating from suspicious users that authenticated through Mobile Access. According to the advisory, follow-up activity can involve internal port and service scanning. This makes post-authentication activity an important part of the investigation. An unusual VPN login should not necessarily be treated as an isolated authentication event. ![CVE-2026-85102](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790158137416-cve-2026-85102.webp) ## CVE-2026-93616: A Newly Discovered Management Zero-Day The second vulnerability, **CVE-2026-93616**, affects Check Point Security Management. Check Point describes it as a **pre-authentication path traversal vulnerability** in the Check Point Management web service. The flaw can allow an attacker to execute a script from an arbitrary path and load an arbitrary Java class. Unlike CVE-2026-85102, which had a fix available before exploitation was observed, Check Point describes CVE-2026-93616 as a newly discovered **zero-day vulnerability**. The company says it identified a handful of pinpointed attacks involving the vulnerability. The advisory states that the observed attacks occurred on **July 23, 2026**. A fix is now available. Check Point says customers running affected versions should apply the fix immediately. ## Which Products and Versions Are Affected? The two vulnerabilities affect different Check Point product areas. **CVE-2026-85102** Affected products listed by Check Point include: - Security Gateway - Spark Firewall, centrally managed - Spark Firewall, locally managed The advisory lists affected releases including R81, R81.10, R81.10.X, R81.20, R82, R82.00.X and R82.10, with some older releases identified as end-of-support. **CVE-2026-93616** The affected product is **Security Management**. Check Point lists affected versions and Jumbo Hotfix levels including: - R82.20 - R82.10 Jumbo Hotfix Take 44 or lower - R82 Jumbo Hotfix Take 126 or lower - R81.20 Jumbo Hotfix Take 166 or lower - R81.10 Jumbo Hotfix Take 190 or lower - Older R80 and R81 releases that are listed as end-of-support Check Point also notes that **LivePatch Take 28/29 does not address CVE-2026-93616**. Organizations should therefore verify their exact release and Jumbo Hotfix level against Check Point's official advisories rather than assuming that an installation is protected based only on its major version. ![check-point](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790158695933-check-point.webp) ## Check Point's Recommended Response For organizations operating affected Check Point systems, the central recommendation is straightforward: **install the applicable security fixes**. Check Point says its remediation documentation contains the affected configurations, exact software versions and Jumbo Hotfix levels, validation commands, alternative mitigation options and upgrade guidance. For CVE-2026-85102, organizations should also review security logs for: 1. Unusual certificate-based Mobile Access logins. 2. Suspicious users accessing Mobile Access. 3. Activity occurring after suspicious authentication. 4. Internal port and service scanning associated with suspicious sessions. Check Point advises defenders not to restrict their investigation to the certificate subjects already observed by the company because the listed subjects are not exhaustive. For CVE-2026-93616, Check Point directs customers to its dedicated security advisory for mitigation guidance, threat hunting information and Indicators of Compromise. ## Why the Active Exploitation Matters The most important aspect of the advisory is not simply the severity score. Both vulnerabilities are rated CVSS 9.8, but Check Point has also confirmed exploitation activity. For CVE-2026-85102, the company first released a fix without evidence of exploitation and later observed exploitation attempts beginning September 12. For CVE-2026-93616, Check Point identified a limited number of targeted attacks associated with the zero-day before publishing its September 22 advisory. This creates two related priorities for defenders. The first is **patching**. Systems running affected versions should be brought to a fixed release according to Check Point's specific remediation guidance. The second is **investigation**. Organizations should not assume that applying a patch automatically answers whether a system was previously targeted. Where exploitation may have occurred before remediation, security teams should review relevant logs and investigate suspicious activity. ![checkpoint-response-workflow](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790158742079-checkpoint-response-workflow.webp) ## What Security Teams Should Take From the Advisory The Check Point advisory highlights an important operational reality in vulnerability management: the risk associated with a critical vulnerability can change quickly once exploitation begins. CVE-2026-85102 had a fix available from September 9, but exploitation attempts were subsequently observed. CVE-2026-93616, meanwhile, was identified as a zero-day with limited exploitation and received a fix through the September 22 advisory. For security teams, this reinforces the importance of maintaining an accurate inventory of firewall and management infrastructure, tracking vendor advisories, applying security updates promptly and reviewing logs when exploitation has been reported. The advisory also demonstrates why version-specific remediation matters. Check Point provides different affected versions and Jumbo Hotfix levels for the two vulnerabilities, so organizations need to verify their exact deployment rather than applying a generic assumption about product security. ## Final Takeaway Check Point has confirmed active exploitation involving **CVE-2026-85102** and **CVE-2026-93616**, two critical pre-authentication vulnerabilities affecting its security infrastructure. CVE-2026-85102 involves VPN certificate validation and can lead to unauthenticated remote code execution. CVE-2026-93616 affects the Management web service and can enable arbitrary-path script execution and Java class loading. Both vulnerabilities carry a **CVSS score of 9.8**, and Check Point has made fixes available. The company recommends immediate remediation for affected systems, along with investigation of potentially suspicious activity. For organizations using affected Check Point products, the practical response is to verify the deployed versions, follow Check Point's applicable remediation guidance and investigate relevant logs where exploitation may have occurred. ## Original source https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616 ## Tags `#CheckPoint` · `#Cybersecurity` · `#CVE2026` · `#ZeroDay` · `#Vulnerability` · `#NetworkSecurity` · `#VPNSecurity` · `#SecurityManagement` --- ## About this content This Markdown news article is the citation-grade twin of [Check Point Warns of Active Exploitation of Two Critical Vulnerabilities](https://www.xcademia.com/news/check-point-warns-of-active-exploitation-of-two-critical-vulnerabilities). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/check-point-warns-of-active-exploitation-of-two-critical-vulnerabilities - Publisher: Xcademia — https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt