Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616

As part of Check Point’s Frontier AI Readiness Program, we continue to release Jumbo hotfixes with security fixes and hardening improvements for our Firewall and Management products. This advisory addresses the active exploitation described below, and the immediate steps customers should take to protect affected systems.

Check Point Research has identified active exploitation of two vulnerabilities affecting Security Gateway and Security Management: A fix for CVE-2026-85102 has been available since September 9, and customers who have applied it are already protected. CVE-2026-93616 is a newly discovered zero-day vulnerability in Security Management, and a fix is available now as part of this advisory.

Fixes are available for both vulnerabilities. Customers running affected versions should install the applicable fixes immediately. Affected versions and remediation instructions are detailed below.

CVE-2026-85102: One day exploitation, patch available since September 9

CVE-2026-85102 is a pre-authentication remote code execution vulnerability in Security Gateway’s VPN certificate handling.

Check Point disclosed the vulnerability and released fixes on September 9, 2026. At the time, we had no evidence of exploitation. We are now observing exploitation attempts against Check Point Spark customers globally. Customers who have not yet installed the fix should do so immediately.

CVE-2026-93616: Zero-day, limited exploitation, fix available today

Separately, Check Point Research has identified a handful of pinpointed exploitation of CVE-2026-93616.

This pre-authentication path traversal vulnerability in the Check Point Management web service allows an attacker to execute a script from an arbitrary path and load an arbitrary Java class. A fix is now available, and customers running affected versions should apply it immediately.

CVE details

Observed Attacks

CVE-2026-85102

Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers. The attempts originated from anonymization infrastructure, including VPN services and proxies, and used certificates with the following subjects:

CN=vpn,OU=users,O=global

CN=vpn-user,OU=users,O=global

CN=vpnuser,OU=users,O=global

These are the subjects we have observed so far. The list is not exhaustive, and other certificate subjects may be in use.

CVE-2026-93616

As of the advisory publications date, we observed a handful of pinpointed attacks on July 23, 2026.

Recommendations

CVE-2026-85102

Review your logs for anomalous certificate-based Mobile Access logins. Do not limit the search to the subjects above.

Look for second stage activity originating from suspicious logged-in users via Mobile Access. Follow-up activity often involves internal port and service scan

CVE-2026-93616

Please refer to sk1000171 for recommendations on mitigation, hunting and Indicators of Compromise

Solution

Install the fixes. Full details and remediation steps, including affected configurations, exact takes and builds, validation commands, alternative mitigation steps, and upgrade guidance, are in the advisories below.

https://support.checkpoint.com/results/sk/sk1000117

https://support.checkpoint.com/results/sk/sk1000171

Need support?

If you need help assessing your exposure, applying a mitigation, or installing the fix, contact Check Point Support at checkpoint.com/support-services/contact-support/