# Check Point Security Gateway VPN Pre-Auth RCE (CVE-2026-85102) and Management Path Traversal Zero-Day (CVE-2026-93616) Actively Exploited

> Check Point confirmed active exploitation of two pre-authentication, unauthenticated CVSS 9.8 vulnerabilities: CVE-2026-85102, an improper-certificate-validation RCE in Security Gateway/Spark VPN negotiation exploited against Spark firewall customers since September 12, 2026; and CVE-2026-93616, a path-traversal/file-upload flaw in the Management web service exploited as a zero-day since July 23, 2026. Both were added to the CISA KEV catalog on September 22, 2026 with a September 25, 2026 federal remediation deadline.

- **Published:** 2026-09-26T00:00:00Z
- **Last reviewed:** 2026-09-28T02:16:28.078Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2677
- **ID:** TL-2026-2677
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-85102, CVE-2026-93616

## Description

Check Point disclosed and patched CVE-2026-85102 and a companion ASN.1 heap-overflow certificate-parsing bug, CVE-2026-85103, on September 9, 2026, reporting no evidence of exploitation at the time. CVE-2026-85102 stems from improper validation of certificate data/trust presented during VPN negotiation on Security Gateway and Spark Firewall devices configured for Site-to-Site or Remote Access VPN, allowing an unauthenticated remote attacker to bypass certificate trust checks during VPN/Mobile Access login and achieve arbitrary code execution on the gateway. On September 10, 2026 the Dutch National Cyber Security Centre (NCSC) warned that exploitation appeared imminent, and on September 12, 2026 Check Point observed a wave of exploitation attempts against Spark (SMB-focused firewall line) customers. The attempts originated from anonymization infrastructure -- commercial VPN services and proxies -- used to conceal the attackers' true source, and employed VPN client certificates bearing subject names crafted to resemble legitimate VPN users (CN=vpn,OU=users,O=global; CN=vpn-user,OU=users,O=global; CN=vpnuser,OU=users,O=global), with Check Point noting the list of observed subjects is not exhaustive. Following successful authentication-bypass, Check Point's hunting guidance directs defenders to look for internal port and service scanning originating from the resulting Mobile Access sessions, indicating post-exploitation reconnaissance.

Separately, on September 22, 2026 Check Point disclosed CVE-2026-93616, a pre-authentication path traversal and unsafe file-upload vulnerability in the Check Point Management web service (listening on TCP/19009) affecting Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. The flaw allows an unauthenticated attacker with network access to the management service to write attacker-controlled files to arbitrary filesystem locations outside the intended upload directory, then execute an uploaded script or load an arbitrary Java class -- achieving full code execution on the management plane without any credentials. Check Point stated it is aware this flaw was exploited as a zero-day beginning July 23, 2026 against "a handful of customers," roughly two months before public disclosure and patch availability; the company did not name the victims, the attackers, or what the attackers did with access after exploitation. Standard LivePatch updates do not remediate CVE-2026-93616 -- a Jumbo Hotfix or the R82.20 Security Hotfix is required.

Both vulnerabilities carry a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflecting network-exploitable, low-complexity, no-privilege, no-interaction attacks with high confidentiality/integrity/availability impact. CISA added both to the Known Exploited Vulnerabilities catalog on September 22, 2026 and set a September 25, 2026 remediation deadline for federal agencies under BOD 22-01/26-04. No threat-actor attribution, named campaign, or specific victim sector/region has been publicly disclosed for either vulnerability; the compromise of internet-facing VPN and management-plane infrastructure is consistent with both opportunistic mass exploitation and targeted initial-access operations, but no source confirms which applies here.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1505.003 Server Software Component: Web Shell
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1090.003 Proxy: Multi-hop Proxy
- T1129 Shared Modules
- T1105 Ingress Tool Transfer
- T1587.003 Develop Capabilities: Digital Certificates
- T1588.006 Obtain Capabilities: Vulnerabilities
- T1583.004 Acquire Infrastructure: Server

## Sources

- [Check Point warns of hackers exploiting Security Gateway VPN RCE flaw](https://www.bleepingcomputer.com/news/security/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw/)
- [Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE](https://thehackernews.com/2026/09/check-point-discloses-two-98-rated-vpn.html)
- [Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks](https://thehackernews.com/2026/09/check-point-warns-of-management-server.html)
- [Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616](https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-85102](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-93616](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93616)
- [NVD - CVE-2026-85102 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-85102)
- [NVD - CVE-2026-93616 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-93616)
- [Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances](https://www.helpnetsecurity.com/2026/09/23/check-point-f5-big-ip-apm-zero-days-targeted/)
- [Check Point Patches Two Critical RCE Bugs in VPN Certificate Handling](https://kudelskisecurity.com/research/check-point-patches-two-critical-rce-bugs-in-vpn-certificate-handling)
- [CVE-2026-93616: Check Point Management Server Zero-Day Exploited in Targeted Attacks](https://socprime.com/blog/cve-2026-93616-check-point-management-server-zero-day-exploited-in-targeted-attacks/)
- [Check Point Patches Exploited Management Server Zero-Day](https://www.securityweek.com/check-point-patches-exploited-management-server-zero-day/)
- [CVE-2026-85102 & CVE-2026-93616: Active Exploitation of Check Point Security Gateway and Security Management Vulnerabilities](https://www.truesec.com/hub/blog/check-point-security-gateway-security-management-cve-2026-85102-cve-2026-93616)
- [Actively Exploited Vulnerabilities in Check Point Security Gateway and Security Management (CVE-2026-93616 and CVE-2026-85102)](https://www.esentire.com/security-advisories/actively-exploited-vulnerabilities-in-check-point-security-gateway-and-security-management-cve-2026-93616-and-cve-2026-85102)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2677