Check Point Security Gateway VPN Pre-Auth RCE (CVE-2026-85102) and Management Path Traversal Zero-Day (CVE-2026-93616) Actively Exploited

Key facts

Detection coverage

As of 2026-09-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2677 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Check Point VPN Cert-Bypass & Management Path Traversal Exploitation — Splunk Primary

Detects pre-authentication exploitation attempts against Check Point Security Gateway/Spark VPN certificate validation (CVE-2026-85102) via the spoofed VPN client certificate subjects Check Point published (CN=vpn / CN=vpn-user / CN=vpnuser, OU=users, O=global), and directory-traversal requests against the Management web service on TCP/19009 that indicate CVE-2026-93616 path-traversal/file-upload exploitation. Both flaws are unauthenticated, CVSS 9.8, and on the CISA KEV catalog as of 2026-09-22.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1133, T1036.005, T1595
• Data sources: checkpoint_vpn_logs, checkpoint_management_web_logs, cef_syslog_firewall
• Severity: critical
• Confidence: high

Splunk SPL

index=checkpoint (sourcetype="checkpoint:vpn" OR sourcetype="checkpoint:management")
| eval cert_subject=coalesce(certificate_subject, cert_cn, subject)
| eval is_spoofed_cert=if(match(cert_subject, "(?i)CN=vpn,OU=users,O=global") OR match(cert_subject, "(?i)CN=vpn-user,OU=users,O=global") OR match(cert_subject, "(?i)CN=vpnuser,OU=users,O=global"), 1, 0)
| eval is_traversal=if(dest_port=19009 AND match(uri_path, "(\.\.\/|%2e%2e%2f|%2e%2e\/)"), 1, 0)
| where is_spoofed_cert=1 OR is_traversal=1
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as source_ips values(cert_subject) as cert_subjects values(uri_path) as uri_paths values(dest_port) as dest_ports by dest_ip
| where count > 0
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceVendor == "Check Point"
| extend IsSpoofedCert = Message has_any ("CN=vpn,OU=users,O=global", "CN=vpn-user,OU=users,O=global", "CN=vpnuser,OU=users,O=global")
| extend IsTraversal = (DestinationPort == 19009 and RequestURL matches regex @"(\.\.\/|%2e%2e%2f)")
| where IsSpoofedCert or IsTraversal
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, Message, DeviceAction
| summarize AttemptCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Subjects = make_set(Message), Paths = make_set(RequestURL) by SourceIP, DestinationIP, DestinationPort
| where AttemptCount > 0

Sigma

title: Check Point VPN Certificate Bypass or Management Path Traversal Exploitation Attempt
id: 8f3c2a1e-4d7b-4e9a-9c1f-2b6a7d5e9f01
status: experimental
description: Detects VPN client certificate subjects associated with CVE-2026-85102 authentication-bypass attempts, or path-traversal sequences against the Check Point Management web service (TCP/19009) associated with CVE-2026-93616 pre-auth file-upload exploitation.
references:
  - https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102
author: Threadlinqs Team
date: 2026-09-26
tags:
  - attack.reconnaissance
  - attack.t1595
  - attack.initial-access
  - attack.t1190
  - attack.t1133
  - attack.defense-evasion
  - attack.t1036.005
  - cve.2026.85102
  - cve.2026.93616
logsource:
  category: firewall
  product: checkpoint
detection:
  sel_cert:
    Message|contains:
      - 'CN=vpn,OU=users,O=global'
      - 'CN=vpn-user,OU=users,O=global'
      - 'CN=vpnuser,OU=users,O=global'
  sel_traversal:
    DestinationPort: 19009
    RequestURL|contains:
      - '../'
      - '%2e%2e%2f'
  condition: sel_cert or sel_traversal
falsepositives:
  - Legitimate VPN users whose organization issues certificates with a generic 'vpn' CN matching the observed subject pattern
  - Internal vulnerability scanners or red-team assessments probing the management port with traversal payloads
level: critical

Known false positives:

• Legitimate VPN users whose organization issues certificates with a generic 'vpn' CN matching the observed subject pattern — verify against your actual PKI naming convention before alerting at high severity
• Internal vulnerability scanning or red-team assessments intentionally probing the Management web service with traversal payloads

Tuning notes: Expand the certificate-subject match list as Check Point publishes additional observed subjects in sk1000117/sk1000171; add your environment's known-good admin source-IP ranges to suppress internal vulnerability-scan noise on TCP/19009.

• 🔒 Check Point VPN Cert-Bypass & Management Path Traversal Exploitation — Sentinel Primary · unlock with TL Creds
• 🔒 Post-Auth-Bypass Recon & Management Web-Shell/Java-Class Drop — Sentinel Primary · unlock with TL Creds
• 🔒 Proxy-Sourced C2/Lateral Config Activity Following VPN Session — Sentinel Primary · unlock with TL Creds
• 🔒 Check Point VPN Cert-Bypass & Management Path Traversal Exploitation — Sigma Primary · unlock with TL Creds
• 🔒 Post-Auth-Bypass Recon & Management Web-Shell/Java-Class Drop — Sigma Primary · unlock with TL Creds
• 🔒 Proxy-Sourced C2/Lateral Config Activity Following VPN Session — Sigma Primary · unlock with TL Creds
• 🔒 Post-Auth-Bypass Recon & Management Web-Shell/Java-Class Drop — Splunk Primary · unlock with TL Creds
• 🔒 Proxy-Sourced C2/Lateral Config Activity Following VPN Session — Splunk Primary · unlock with TL Creds

Indicators of compromise

As of 2026-09-28, Threadlinqs Intelligence tracks 22 indicators of compromise for TL-2026-2677.

Technical analysis

Both were added to the CISA KEV catalog on September 22, 2026 with a September 25, 2026 federal remediation deadline.

Check Point disclosed and patched CVE-2026-85102 and a companion ASN.1 heap-overflow certificate-parsing bug, CVE-2026-85103, on September 9, 2026, reporting no evidence of exploitation at the time. CVE-2026-85102 stems from improper validation of certificate data/trust presented during VPN negotiation on Security Gateway and Spark Firewall devices configured for Site-to-Site or Remote Access VPN, allowing an unauthenticated remote attacker to bypass certificate trust checks during VPN/Mobile Access login and achieve arbitrary code execution on the gateway. On September 10, 2026 the Dutch National Cyber Security Centre (NCSC) warned that exploitation appeared imminent, and on September 12, 2026 Check Point observed a wave of exploitation attempts against Spark (SMB-focused firewall line) customers. The attempts originated from anonymization infrastructure -- commercial VPN services and proxies -- used to conceal the attackers' true source, and employed VPN client certificates bearing subject names crafted to resemble legitimate VPN users (CN=vpn,OU=users,O=global; CN=vpn-user,OU=users,O=global; CN=vpnuser,OU=users,O=global), with Check Point noting the list of observed subjects is not exhaustive. Following successful authentication-bypass, Check Point's hunting guidance directs defenders to look for internal port and service scanning originating from the resulting Mobile Access sessions, indicating post-exploitation reconnaissance.

Separately, on September 22, 2026 Check Point disclosed CVE-2026-93616, a pre-authentication path traversal and unsafe file-upload vulnerability in the Check Point Management web service (listening on TCP/19009) affecting Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. The flaw allows an unauthenticated attacker with network access to the management service to write attacker-controlled files to arbitrary filesystem locations outside the intended upload directory, then execute an uploaded script or load an arbitrary Java class -- achieving full code execution on the management plane without any credentials. Check Point stated it is aware this flaw was exploited as a zero-day beginning July 23, 2026 against "a handful of customers," roughly two months before public disclosure and patch availability; the company did not name the victims, the attackers, or what the attackers did with access after exploitation. Standard LivePatch updates do not remediate CVE-2026-93616 -- a Jumbo Hotfix or the R82.20 Security Hotfix is required.

Both vulnerabilities carry a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflecting network-exploitable, low-complexity, no-privilege, no-interaction attacks with high confidentiality/integrity/availability impact. CISA added both to the Known Exploited Vulnerabilities catalog on September 22, 2026 and set a September 25, 2026 remediation deadline for federal agencies under BOD 22-01/26-04. No threat-actor attribution, named campaign, or specific victim sector/region has been publicly disclosed for either vulnerability; the compromise of internet-facing VPN and management-plane infrastructure is consistent with both opportunistic mass exploitation and targeted initial-access operations, but no source confirms which applies here.

MITRE ATT&CK techniques by tactic:

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery

Defense Evasion

T1036.005 Masquerading: Match Legitimate Resource Name or Location

Execution

T1059 Command and Scripting Interpreter; T1129 Shared Modules

Command and Control

T1090.003 Proxy: Multi-hop Proxy; T1105 Ingress Tool Transfer

Initial Access

T1133 External Remote Services; T1190 Exploit Public-Facing Application

Persistence

T1505.003 Server Software Component: Web Shell

Resource Development

T1583.004 Acquire Infrastructure: Server; T1587.003 Develop Capabilities: Digital Certificates; T1588.006 Obtain Capabilities: Vulnerabilities

Reconnaissance

T1595 Active Scanning

Remediation

Patches

• LivePatch Take 26 (R81.20, R82, R82.10) -- CVE-2026-85102 / CVE-2026-85103
• Jumbo Hotfix R81.20 Take 166 / R82 Take 126 / R82.10 Take 44 / R81.10 Take 190 -- CVE-2026-85102 / CVE-2026-85103
• Spark Firewall R82.00.10 Build 2325 / R81.10.17 Build 4968 -- CVE-2026-85102
• R82.20 Security Hotfix; Jumbo Hotfix R82.10 Take 45 / R82 Take 127 / R81.20 Take 170 / R81.10 Take 192 -- CVE-2026-93616

Immediate actions

• Apply Check Point LivePatch Take 26 on R81.20/R82/R82.10 Security Gateways to remediate CVE-2026-85102
• Install the applicable Jumbo Hotfix (R81.20 Take 166, R82 Take 126, R82.10 Take 44, or R81.10 Take 190) if LivePatch cannot be applied, to remediate CVE-2026-85102
• Update Spark Firewalls (locally and centrally managed) to R82.00.10 Build 2325 or R81.10.17 Build 4968
• Apply the R82.20 Security Hotfix, or Jumbo Hotfix R82.10 Take 45 / R82 Take 127 / R81.20 Take 170 / R81.10 Take 192, to Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent to remediate CVE-2026-93616 -- standard LivePatch does not fix this CVE
• Hunt Mobile Access / Remote Access VPN authentication logs for the published certificate subjects (CN=vpn,OU=users,O=global; CN=vpn-user,OU=users,O=global; CN=vpnuser,OU=users,O=global) and for any anomalous certificate-based logins with unrecognized subject names
• Review Check Point support articles sk1000117 (CVE-2026-85102) and sk1000171 (CVE-2026-93616) for vendor-provided hunting guidance and indicators of compromise

Workarounds

• Disable VPN implied rules and create explicit firewall rules restricting Site-to-Site VPN (UDP/500, UDP/4500) to specific, known peer IP addresses
• Restrict network access to the Management web service (TCP/19009) to trusted administrator IP addresses when the Security/Jumbo Hotfix for CVE-2026-93616 cannot be applied immediately

Longer-term hardening

• Remove direct internet exposure of Check Point Management Server / TCP-19009 web services; place management interfaces behind a Security Gateway or dedicated management network with access restricted to trusted administrator IP ranges
• Establish continuous patch-compliance tracking across all deployed Security Gateway, Spark, and Security Management Server instances given the two-month unpatched exposure window observed for CVE-2026-93616
• Deploy detection content for post-authentication-bypass behavior on VPN gateways, including internal network/port scanning originating from newly established Mobile Access sessions

Affected and fixed versions

• Check Point — Quantum Security Gateway
  Vulnerable versions: R81 (EOS); R81.10 (Jumbo Hotfix Take 189 or below); R81.20 (Jumbo Hotfix Take 165 or below); R82 (Jumbo Hotfix Take 125 or below); R82.10 (Jumbo Hotfix Take 43 or below)
  Fixed in: LivePatch Take 26 (R81.20/R82/R82.10); R81.20 Jumbo Hotfix Take 166; R82 Jumbo Hotfix Take 126; R82.10 Jumbo Hotfix Take 44; R81.10 Jumbo Hotfix Take 190
• Check Point — Spark Firewall (locally and centrally managed)
  Vulnerable versions: builds prior to fixed release
  Fixed in: R82.00.10 Build 2325; R81.10.17 Build 4968
• Check Point — Security Management Server / Multi-Domain Security Management Server / Log Server / Multi-Domain Log Server / SmartEvent
  Vulnerable versions: R82.20 (without Security Hotfix); R82.10 (Jumbo Hotfix Take 44 or below); R82 (Jumbo Hotfix Take 126 or below); R81.20 (Jumbo Hotfix Take 169 or below); R81.10 (Jumbo Hotfix Take 191 or below); R81; R80.40; R80.30; R80.20; R80.10
  Fixed in: R82.20 Security Hotfix; R82.10 Jumbo Hotfix Take 45; R82 Jumbo Hotfix Take 127; R81.20 Jumbo Hotfix Take 170; R81.10 Jumbo Hotfix Take 192

Timeline

Last updated 2026-09-28 · 2 updates · revalidated 2× · latest source

• 2026-07-23 Check Point later confirms CVE-2026-93616 exploitation began against a handful of Management Server customers as an undisclosed zero-day.
• 2026-09-07 Check Point internally identifies the VPN certificate-handling flaws affecting Security Gateway and Spark Firewall (CVE-2026-85102 and companion CVE-2026-85103), ahead of the September 9 public disclosure.
• 2026-09-09 The Canadian Centre for Cyber Security publishes an advisory on the newly disclosed Check Point VPN certificate vulnerabilities.
• 2026-09-09 Check Point discloses and patches CVE-2026-85102 and companion flaw CVE-2026-85103 (VPN certificate handling), begins LivePatch rollout; reports no evidence of exploitation at time of disclosure.
• 2026-09-10 Dutch National Cyber Security Centre (NCSC) alerts on the Security Gateway VPN certificate issue and warns that imminent exploitation is expected.
• 2026-09-12 Check Point observes a wave of exploitation attempts against CVE-2026-85102 targeting Spark firewall customers, originating from anonymization VPN services and proxies using spoofed VPN-user certificate identities.
• 2026-09-16 Check Point LivePatches a separate, distinct management-server flaw, CVE-2026-91843, via Take 28/29 on R82.20 -- not part of the CVE-2026-93616 KEV addition, but relevant context on the same management-plane attack surface during this window.
• 2026-09-22 CISA adds both CVE-2026-85102 and CVE-2026-93616 to the Known Exploited Vulnerabilities (KEV) catalog.
• 2026-09-22 Check Point publicly discloses CVE-2026-93616 (Management web service path traversal), releases the R82.20 Security Hotfix and Jumbo Hotfixes, and publishes hunting guidance/IOCs in support article sk1000171.
• 2026-09-23 Check Point publishes a combined 'Action Required' security advisory confirming active exploitation of both CVE-2026-85102 and CVE-2026-93616; coverage follows from BleepingComputer, SecurityWeek, Help Net Security, and others.
• 2026-09-25 CISA's BOD 26-04 remediation deadline for federal agencies to mitigate CVE-2026-85102 and CVE-2026-93616 takes effect.

Update history

• 2026-09-28 — Check Point Security Gateway and Management Server Flaws (CVE-2026-85102, CVE-2026-93616) Actively Exploited, Added to CISA KEV: What changed No severity/exploitability/status escalation -- both remain CRITICAL/ACTIVE/ACTIVE with CVSS 9.8, consistent with the existing record. New indicators (8) Indicator values are withheld at this access level.
• 2026-09-28 — Check Point Pre-Auth Flaws (CVE-2026-85102, CVE-2026-93616) Under Active Attack: What changed No severity, exploitability, or status change (remains CRITICAL / ACTIVE / ACTIVE, CVSS 9.8 on both).

Sources cited

• CISA Known Exploited Vulnerabilities Catalog - CVE-2026-85102 CISA · Government advisory · 2026-09-22
• CISA Known Exploited Vulnerabilities Catalog - CVE-2026-93616 CISA · Government advisory · 2026-09-22
• NVD - CVE-2026-85102 Detail NVD (NIST) · Advisory · 2026-09-09
• NVD - CVE-2026-93616 Detail NVD (NIST) · Advisory · 2026-09-22
• Actively Exploited Vulnerabilities in Check Point Security Gateway and Security Management (CVE-2026-93616 and CVE-2026-85102) esentire.com · Advisory · 2026-09-23
• Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616 Check Point · Vendor report · 2026-09-22
• Check Point Patches Two Critical RCE Bugs in VPN Certificate Handling kudelskisecurity.com · Research · 2026-09-09
• CVE-2026-93616: Check Point Management Server Zero-Day Exploited in Targeted Attacks socprime.com · Blog · 2026-09-22
• CVE-2026-85102 & CVE-2026-93616: Active Exploitation of Check Point Security Gateway and Security Management Vulnerabilities truesec.com · Blog · 2026-09-23
• Check Point warns of hackers exploiting Security Gateway VPN RCE flaw BleepingComputer · News · 2026-09-23
• Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE The Hacker News · News · 2026-09-09
• Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks The Hacker News · News · 2026-09-22
• Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances Help Net Security · News · 2026-09-23
• Check Point Patches Exploited Management Server Zero-Day SecurityWeek · News · 2026-09-22

More in vulnerability

• Critical Zoom Workplace for Windows Flaws (CVE-2026-108186, CVE-2026-108187) Allow Unauthenticated Remote Privilege Escalation
• Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)
• Ivanti EPM SQLi RCE (CVE-2026-121653) and CSA Missing Authentication (CVE-2026-121683); Citrix XenServer and Ivanti Sentry/EPMM Patches
• Git Fixes 6 Vulnerabilities Enabling Code Execution via Cloned Repositories (CVE-2026-111760 et al.)
• CVE-2024-0244 – Unauthenticated Heap Buffer Overflow in Canon MF753Cdw Printer (Fax Job Handling, /wsd/print)

Related coverage of this activity

Other reports on CVE-2026-85102

• CISA Adds Four Actively Exploited KEVs: Check Point Gateway/Management RCE Flaws, Arista VeloCloud Orchestrator Auth Bypass, F5 BIG-IP APM Heap Overflow
• Eclypsium InfraTrust Report: Mass Active Exploitation of Network Management Systems (Cisco FMC/ISE CVE-2026-20079, CVE-2026-76460; SonicWall SMA 1000 CVE-2026-83548/83549; Linux Kernel CopyFail CVE-2026-31431)
• Dutch NCSC Warns of Critical Check Point VPN Flaws (CVE-2026-85102, CVE-2026-85103) — Exploitation Expected Imminently

Other reports on CVE-2026-93616

• Eclypsium InfraTrust Pulse (Oct 2026): Actively Exploited Flaws Across Network Infrastructure Appliances (NetScaler CVE-2026-88771, Ivanti CVE-2026-104935, Check Point CVE-2026-93616, Cisco, Arista VeloCloud, FortiMail, F5 BIG-IP APM, PAN-OS, PHP2Shell, Linux Copy Fail)

Previous and next in vulnerability

• Microsoft Titan Analytics JWT 'alg:none' Authentication Bypass Exposed Access to 17.3 Trillion ClickHouse Rows Previous report