460.23.09.26- Critical Check Point Vulnerabilities Under Active Exploitation CVE

Two critical vulnerabilities, CVE-2026-85102 and CVE-2026-93616, are actively being exploited against Check Point Security Gateway, Spark Firewall, and Security Management products. These flaws possess a high CVSS score of 9.8, potentially allowing unauthenticated remote attackers to compromise affected systems. Exploitation has been observed in the wild since September 23, 2026, by the Trinidad and Tobago Cyber Security Incident Response Team.
The vulnerabilities are distinct: CVE-2026-85102 is a one-day exploitation vulnerability related to pre-authentication remote code execution in the Security Gateway’s VPN certificate handling, and a zero-day, limited exploitation path traversal vulnerability in the Check Point Management web service. Affected versions span various products, including specific releases of Security Gateway, Spark Firewall, and Security Management components.
Immediate action is required for organizations using these products to review their environments and apply security fixes provided by Check Point. Specific detection indicators point toward anomalous certificate-based Mobile Access authentication, unusual administrative activity, and suspicious network scanning following logins. Patches are available via specific Check Point Security Knowledge Base articles.

CVE-2026-85102 is a one-day exploitation pre-authentication remote code execution vulnerability in the Security Gateway’s VPN certificate handling.
CVE-2026-85102 also involves a zero-day, limited exploitation pre-authentication path traversal vulnerability in the Check Point Management web service.
The affected products for CVE-2026-85102 include Security Gateway and Spark Firewall (Centrally Managed and Locally Managed).
Affected versions for CVE-2026-85102 include R81 (EOS), R81.10 (EOS), R81.10.X, R81.20, R82, R82.00.X, R82.00.X, and R82.10.
CVE-2026-93616 affects the Security Management product.
Affected versions for CVE-2026-93616 include specific versions of R82 Jumbo Hotfix Take 44 or lower, R82 Jumbo Hotfix Take 126 or lower, R81.20 Jumbo Hotfix Take 166 or lower, and R81.10 Jumbo Hotfix Take 190 or lower (EoS), as well as R80, R80.10, R80.20, R80.30, R80.40, and R81 (all EoS).
Check Point Live Patch Take 28/29 does not remediate CVE-2026-93616.
Exploitation attempts for CVE-2026-85102 were observed originating from anonymization infrastructure, including VPN services and proxy networks.
Observed malicious certificate subjects included CN=vpn,OU=users,O=global; CN=vpn-user,OU=users,O=global; and CN=vpnuser,OU=users,O=global.
Detection indicators include reviewing logs for unusual certificate-based Mobile Access logins, unexpected Mobile Access users, authentication from unusual IP addresses, internal network scanning post-login, and unusual administrative activity on Security Management systems.
Patches are available via Check Point SK1000117 for CVE-2026-85102 and Check Point SK1000171 for CVE-2026-93616.

The simultaneous, high-severity exploitation of two distinct vulnerabilities across core security products—one related to remote code execution in VPN handling and the other a path traversal flaw in management services—indicates a systemic risk being leveraged by threat actors. The focus on certificate handling (CVE-2026-85102) suggests an attempt to establish unauthorized access through established trust mechanisms, while the management service vulnerability implies a vector for deeper system compromise once initial access is gained.
The indicators observed—focusing on anomalous Mobile Access logins and activity originating from anonymized infrastructure—suggest that threat actors are exploiting legitimate remote access functions (VPN/Mobile Access) as the primary entry point to escalate privileges or pivot within the network, rather than brute-forcing system credentials directly. The pattern of observation, tracking certificate subjects associated with VPN roles, suggests a tailored reconnaissance strategy targeting authenticated sessions.
This situation highlights a tension between known product exposure and the operational reality of defense. While vendors provide specific remediation steps, the observed exploitation relies on exploiting the trust inherent in network access protocols. The implication is that perimeter defenses and internal segmentation controls are insufficient to stop sophisticated attacks that leverage zero-day or actively exploited flaws within the software stack itself. What systems are relying solely on authentication checks without sufficient context validation for lateral movement? How does the reliance on Live Patch mechanisms interact with the real-time demands of active exploitation?