Check Point management server administrators can now close a critical zero-day path traversal flaw that attackers exploited in targeted attacks, while Spark firewall customers need to verify that the September 9 VPN fix is installed.
According to The Hacker News, Check Point released the management server fix on September 22 for CVE-2026-93616. Separately, the company said attackers had attempted to exploit a VPN certificate flaw affecting Spark firewalls since September 12.
What happened
According to The Hacker News, attackers exploited CVE-2026-93616 in a handful of targeted attacks on July 23, 2026. Check Point released a fix on September 22 for the Security Management Server, which controls firewall policies for the gateways it manages.
Check Point also reported active attempts to exploit CVE-2026-85102, a separate VPN flaw it fixed on September 9. The attempts targeted Spark, its firewall line for small businesses.
Are you affected?
CVE-2026-93616 affects Check Point Security Management servers. The CVE record lists R82.20 with no Jumbo Hotfix, R82.10 with Jumbo Hotfix Take 44 or below, R82 with Take 126 or below, R81.20 with Take 166 or below, and R81.10 with Take 190 or below. R81, R80.40, R80.30, R80.20, R80.10 and R80 are listed as affected and are end of support.
Check Point’s advisory lists R82.20 as affected without the no-Jumbo-Hotfix condition. The LivePatch for CVE-2026-91843, released September 16 as Take 28 or Take 29 on R82.20, does not fix CVE-2026-93616.
Administrators can compare the server release and Jumbo Hotfix take with the affected list. An unauthenticated patch-state check from BishopFox targets the Check Point management SOAP service on TCP port 19009. It can identify vulnerable, patched and inconclusive responses, including end-of-support releases, but its documentation says that a result other than vulnerable does not by itself prove that a server is patched. The check is for management servers, not gateways.
The separate CVE-2026-85102 issue affects centrally or locally managed Security Gateway and Spark firewalls running R81, R81.10, R81.10.x, R81.20, R82, R82.00.x or R82.10. The Netherlands’ National Cyber Security Centre says it applies when those products use Site-to-Site VPN or Remote Access VPN.
The GitHub Advisory Database also records CVE-2026-85103 as critical with a 9.8 CVSS score. It states that a heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems. The advisory lists affected and patched versions as unknown, so administrators should use Check Point’s support guidance for this issue.
What to do now
- Compare each management server’s release and Jumbo Hotfix take with the affected list, then follow Check Point’s published guidance for remediation.
- Use Check Point’s published hunting guidance and indicators of compromise to look for signs of an attack. Installing the fix alone does not establish whether the server was attacked.
- Follow Check Point’s published guidance for CVE-2026-85102 and determine whether the fix has been applied to affected systems.
- Review Mobile Access logs for unusual certificate-based logins. Check Point says the list is incomplete, so administrators should investigate other unusual certificate activity as well.
- Review what suspicious Mobile Access users did after signing in, particularly scans of internal ports and services. Follow the applicable official guidance for gateways that cannot yet be patched.
Why the management server fix needs special attention
CVE-2026-93616 is a path traversal flaw in the management server’s web service. According to the CVE record, Check Point rated it 9.8 out of 10. BishopFox’s technical analysis says the UpgradeSvcRemote login method passes its targetVersion parameter into a filesystem path used by Runtime.exec without validation, allowing an unauthenticated caller to redirect execution to an attacker-selected script.
Administrators should include the management server in the organization’s patch planning.
Check Point’s advisory names only Security Management as affected for CVE-2026-93616 and does not state what network access an attacker needs. The company also has not named the July attack targets or attackers, and has not said what happened after the flaw was exploited.
How the VPN exploitation attempts appeared
CVE-2026-85102 affects the certificate-checking stage of VPN connection setup. It may allow an unauthenticated attacker to run code on the gateway. Check Point said the attempts originated from anonymizing infrastructure, including VPN services and proxies.
The company had no evidence of exploitation when it released the September 9 fix. It later said customers that installed that fix were protected, but its advisory did not state whether any attempted exploitation succeeded. Administrators should review the logs for evidence of the attempts.
FAQ
What is CVE-2026-93616 in Check Point?
CVE-2026-93616 is a path traversal vulnerability in the Security Management Server’s web service, rated 9.8 on the CVSS scale. According to The Hacker News, it allows an attacker who can access the web service to run scripts on it without logging in. Check Point said attackers exploited it in targeted attacks on July 23, 2026.
Which Check Point versions need the CVE-2026-93616 fix?
Affected versions include R82.20 with no Jumbo Hotfix, R82.10 with Jumbo Hotfix Take 44 or below, R82 with Take 126 or below, R81.20 with Take 166 or below, and R81.10 with Take 190 or below, plus older end-of-support releases R81 through R80.
How do I protect a Check Point Spark firewall from CVE-2026-85102?
Follow Check Point’s published guidance for CVE-2026-85102. Check Point said customers who installed the September 9 fix were protected, while its advisory did not state whether any attempted exploitation succeeded. Follow the applicable official guidance for gateways that cannot yet be patched.