Loading story…
Check Point released emergency fixes for two actively exploited critical vulnerabilities: CVE-2026-93616 (CVSS 9.8), affecting network-security management products, and CVE-2026-85102, affecting Security Gateway Spark Firewall devices. The management-server flaw allows an unauthenticated attacker to upload and execute arbitrary scripts, while the VPN certificate-validation flaw can enable authentication bypass and remote code execution during VPN negotiation. Check Point published indicators of compromise, patches, and risk-mitigation guidance.
CISA added both Check Point flaws to its Known Exploited Vulnerabilities catalog alongside exploited issues in Arista VeloCloud Orchestrator and F5 BIG-IP Access Policy Manager. U.S. federal civilian agencies were directed to remediate all four cataloged vulnerabilities by September 25, 2026; organizations using affected Check Point management servers or Spark gateways should prioritize patching, review published IoCs, and investigate systems for evidence of compromise.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
CISA added Check Point CVE-2026-85102 and CVE-2026-93616, Arista VeloCloud Orchestrator CVE-2026-93952, and F5 BIG-IP APM CVE-2026-94127 to its Known Exploited Vulnerabilities catalog. It directed U.S. federal civilian executive branch agencies to remediate all four by September 25, 2026.
F5 disclosed CVE-2026-94127, a heap-based buffer overflow in BIG-IP Access Policy Manager configurations acting as an OAuth Authorization Server, and confirmed exploitation had been observed. The flaw can enable unauthenticated arbitrary code execution.
Check Point issued advisories sk1000117 and sk1000118 for its vulnerabilities and corrected the CVE-2026-85102 VPN certificate-validation flaw. The flaw could allow unauthenticated attackers to bypass authentication checks and execute code on affected gateways.
The Dutch NCSC warned that CVE-2026-85102 could soon be actively exploited. The vulnerability affects Check Point VPN negotiation and permits authentication bypass and potential code execution.
Exploitation attempts targeting Check Point Spark Firewall customers were observed globally for CVE-2026-85102. The vulnerability stems from improper certificate-data validation during VPN negotiation.
Check Point confirmed that CVE-2026-93616, a CVSS 9.8 path-traversal and file-upload flaw in Security Management Server-related products, had been exploited against a limited number of customers. The company released an R82.20 Security Hotfix and other Jumbo Hotfix updates, and published indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point VPN products are affected by critical vulnerabilities `CVE-2026-85102` and `CVE-2026-85103` that can be exploited remotely without credentials to bypass security controls and execute attacker-controlled code. `CVE-2026-85102`, rated CVSS 9.8, results from improper validation of certificate data during VPN negotiation in certificate-authenticated VPN functionality; exploitation against Spark Firewalls has been observed since September 12. A successful attack can fully compromise an affected gateway, expose or alter sensitive information, and disrupt services. Affected deployments include Security Gateway and Spark Firewall Remote Access and Site-to-Site VPN configurations using certificate authentication, including DAIP and LSV setups where it may be implicitly enabled. Pre-Shared Key-only VPN configurations and version R82.20 are not affected. Check Point has released LivePatch and Jumbo Hotfix Accumulator remediation options, and the NCSC recommends immediate patching; organizations using Site-to-Site VPN should also disable implied rules and restrict VPN access to specified IP addresses.
Sep 24, 2026
Check Point issued emergency updates for two critical vulnerabilities, **CVE-2026-85102** and **CVE-2026-85103**, affecting Quantum Security Gateways, Security Management systems, Spark Firewalls, and Remote Access and Site-to-Site VPN deployments. An unauthenticated attacker could exploit flaws in certificate handling during VPN negotiation to execute arbitrary code on exposed perimeter appliances; CVE-2026-85102 involves improper certificate validation and authentication bypass, while CVE-2026-85103 is a heap overflow in ASN.1 certificate decoding. Check Point has provided fixes through LivePatch and Jumbo Hotfix Accumulator packages. Organizations should apply available updates promptly and, where patching is delayed, reduce VPN exposure using implied-rule and UDP-port controls. No public proof-of-concept exploit was reported at disclosure, but internet-facing VPN infrastructure is a high-priority remediation target.
Sep 15, 2026
Check Point released fixes for **CVE-2026-18574**, a critical authentication-bypass flaw in **Security Management Server** and **Multi-Domain Security Management Server (MDS)** that can let an unauthenticated remote attacker with network access to management services execute arbitrary commands. The vulnerability carries a **CVSS 4.0 score of 9.3** and is classified as **`CWE-288`**, with impact that can extend to full compromise of the security management environment. Check Point said it discovered the issue internally and reported no evidence of active exploitation, while noting that **Smart-1 Cloud** customers are already protected. Supported affected versions include **R81.20, R82, and R82.10**, with older affected releases from **R80 through R81.10** now end-of-support; fixes were issued through **Jumbo Hotfix Accumulator** updates. The company urged customers to apply patches, restrict **Trusted Clients**, limit management access to trusted administrator systems, avoid exposing management interfaces to untrusted networks or the public internet, and monitor for unauthorized activity.
Aug 8, 2026