erroneo.us
Search all guides⌘K

Security Digest · Sep 9, 2026 · Vulnerability · Network edge

Check Point: Exploited VPN Gateway and Management RCEs

Pre-auth RCE in Check Point VPN certificate handling and in Management Servers, both exploited and in KEV. Patch gateways and management servers separately.

Published By erroneo.us Security Desk · Updated 4 min read8 sources

Our verdict

Act now

Check Point shops should patch both gateways and management servers now: each flaw is unauthenticated RCE, both are exploited, and fixing one tier does not fix the other.

Who must act: Anyone running Check Point Security Gateways or Spark firewalls with Remote Access VPN or certificate-based Site-to-Site VPN, and anyone running on-prem Security Management, Multi-Domain, Log or SmartEvent servers.

Who can relax: Smart-1 Cloud customers (already fixed for the management bug), R82.20 gateways (not affected by the VPN bug), gateways that only use pre-shared-key Site-to-Site VPN with no Remote Access VPN, and non-Check Point shops.

Affected
Security Gateway R81.20 / R82 / R82.10 below the fixed Jumbo Hotfix or LivePatch Take 26, plus EoS R80-R81.10 (CVE-2026-85102)
Spark Firewall R82.00.x before R82.00.10 Build 2325 and R81.10.x before R81.10.17 Build 4968 (CVE-2026-85102)
Management, Multi-Domain, Log, Multi-Domain Log and SmartEvent servers: R82.20 without a Jumbo, R82.10 Take 44 or lower, R82 Take 126 or lower, R81.20 Take 166 or lower, R81.10 Take 190 or lower, R80-R81 (CVE-2026-93616)
Fixed in
Gateways: LivePatch Take 26 (R82.10, R82, R81.20) or Jumbo Hotfix R82.10 Take 44, R82 Take 126, R81.20 Take 166, R81.10 Take 190 or later
Spark: R82.00.10 Build 2325 or R81.10.17 Build 4968 or later
Management/Log/SmartEvent: R82.20 Security Hotfix, or Jumbo Hotfix R82.20 Take 10, R82.10 Take 45, R82 Take 127, R81.20 Take 170, R81.10 Take 192 or later
CVSS
9.8 (v3.1, CNA)
EPSS
75.9% (percentile 99.5)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Inventory every gateway, Spark appliance and management, log and SmartEvent server, with version and Jumbo Hotfix take.
  2. Patch gateways with LivePatch Take 26 or the fixed Jumbo Hotfix, then confirm with cplp list that CVE-2026-85102 and CVE-2026-85103 are covered.
  3. Update Spark firewalls to R82.00.10 Build 2325 or R81.10.17 Build 4968.
  4. Patch management, log and SmartEvent servers separately (Security Hotfix or Jumbo R82.20 Take 10, R82.10 Take 45, R82 Take 127, R81.20 Take 170, R81.10 Take 192); LivePatch does not fix CVE-2026-93616.
  5. Allow TCP/19009 and other management access only from trusted IPs, and restrict Trusted Clients in SmartConsole.
  6. If gateway patching must wait, replace VPN implied rules with explicit rules limiting UDP/500 and UDP/4500 (and TCP/443/80 for Remote Access) to known peers or client ranges.

How to check if you are affected or compromised

  • On gateways, search logs since Sep 12, 2026 for product 'Mobile Access' log-ins with action 'Certificate', especially subjects CN=vpn, CN=vpn-user or CN=vpnuser with OU=users,O=global.
  • On management, log and SmartEvent servers, search $MDS_FWDIR/log/cpm.elg* for login requests with usernames longer than 1,000 characters, and check /var/log/dump/usermode/ for FWM or MDS core dumps at the same time.
  • Search cpm.elg* for method version paths or file uploads containing traversal sequences or encoded separators, especially ones aimed at CPupgrade-tools locations.
  • Investigate unknown VPN users, clients or source IPs and any internal port scanning that follows.

What happened#

Check Point customers have two separate exploited, unauthenticated code-execution bugs to fix, one on each tier of the product.

CVE-2026-85102 (gateways). On September 9, 2026, Check Point shipped fixes for "improper validation of certificate data during VPN negotiation" that "may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway" (sk1000117, CVSS 9.8). BleepingComputer reported the Dutch NCSC's warning that exploitation was imminent, and described a companion bug, CVE-2026-85103, as a heap overflow in the VPN certificate ASN.1 decoder. Check Point later updated its advisory to say the flaw "is actively exploited on Spark Firewalls as of September 12, 2026," with attempts coming from VPN services and proxies.

CVE-2026-93616 (management). sk1000171 describes a directory traversal and file upload flaw that lets an unauthenticated attacker upload and run scripts on the Management Server (CVSS 9.8). Check Point says it "is exploited in the Wild" and that it is aware of "a handful of customers who have been attacked." According to BleepingComputer, Check Point says exploitation as a zero-day dates back to July 23. CISA added both CVEs to the KEV catalog on September 22 (CVE-2026-85102, CVE-2026-93616) with a federal deadline of September 25.

Who is affected#

Gateway bug: Security Gateways and Spark firewalls on R81.20, R82, R82.10, R81.10.x and R82.00.x, plus end-of-support R80 through R81.10, that run Remote Access VPN or Site-to-Site VPN with certificate authentication. DAIP and Large Scale VPN communities turn certificate authentication on. Gateways that only take part in pre-shared-key communities are not vulnerable, and R82.20 is not affected. The CVE record lists R82.10 Take 43, R82 Take 125 and R81.20 Take 165 or below as affected.

Management bug: Security Management, Multi-Domain Management, Log Server, Multi-Domain Log Server and SmartEvent on R82.20 without a Jumbo, R82.10 Take 44 or lower, R82 Take 126 or lower, R81.20 Take 166 or lower, R81.10 Take 190 or lower, and R80 through R81 (CVE record). Smart-1 Cloud is already fixed. Firewall appliances and Spark are not affected.

Do you really need to act?#

If you run Check Point, yes. The VPN listener faces the internet by design. The management server is often reachable from more places than it should be, and owning it means owning policy for every gateway it manages. One detail traps teams: a management server on R82.10 Take 44, the gateway fix level, is still vulnerable to CVE-2026-93616, which needs Take 45. Check Point also says LivePatch does not cover the management bug and will not, so it needs a real hotfix install. Shops that use Check Point only with pre-shared-key site-to-site tunnels and no remote-access VPN have a narrower gateway risk, but still need the management fix.

What to do now#

  1. Inventory gateways, Spark units and management, log and SmartEvent servers by version and Jumbo take.
  2. Gateways: install LivePatch Take 26 or the fixed Jumbo Hotfix. In Expert mode, run cpinfo -y CPupdates and cplp list (g_all cplp list on Scalable Platform) and confirm CVE-2026-85102 and CVE-2026-85103 appear. Earlier offline LivePatch packages need Take 26 for full coverage.
  3. Spark: update to R82.00.10 Build 2325 or R81.10.17 Build 4968.
  4. Management tier: install the R82.20 Security Hotfix (no reboot) or Jumbo R82.20 Take 10, R82.10 Take 45, R82 Take 127, R81.20 Take 170 or R81.10 Take 192.
  5. Allow TCP/19009 only from trusted IPs, and restrict Trusted Clients under Manage & Settings > Permissions & Administrators.
  6. If gateways cannot be patched yet, disable the VPN implied rules and allow UDP/500 and UDP/4500 (plus TCP/443 and TCP/80 for Remote Access) only from known peers or client ranges. Check Point notes this does not apply to locally managed Spark.

How to tell if you were hit#

On gateways, search logs from September 12 onward for product "Mobile Access" with actions "Log In" and "Certificate," especially certificate subjects CN=vpn, CN=vpn-user or CN=vpnuser with OU=users,O=global. Check Point says the list is not exhaustive. Follow up on unknown users or source IPs, and on internal scanning that comes after a login. On each management, log and SmartEvent server, grep $MDS_FWDIR/log/cpm.elg* for login requests with usernames over 1,000 characters, and look for matching FWM or MDS core dumps in /var/log/dump/usermode/. Also look for version paths or uploads containing traversal sequences aimed at CPupgrade-tools. Check Point says a match means a possible attempt, not confirmed compromise.

Timeline#

  • — Zero-day exploitation of CVE-2026-93616 begins, per Check Point via BleepingComputer.
  • — Check Point releases fixes for CVE-2026-85102 and CVE-2026-85103.
  • — The Dutch NCSC warns that exploitation is imminent.
  • — Exploitation attempts against Spark customers begin.
  • — The CVE-2026-93616 record is published. CISA adds both CVEs to KEV.

Vulnerability records

  • CVE-2026-85102 · KEV 2026-09-22 · Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute…
  • CVE-2026-93616 · KEV 2026-09-22 · A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Check Point — sk1000117: CVE-2026-85102 Authentication Bypass and RCE in Remote Access and Site-to-Site VPN support.checkpoint.com
  2. Check Point — sk1000171: CVE-2026-93616 Directory Traversal and File upload on the Management Server support.checkpoint.com
  3. CVE record — CVE-2026-85102 cve.org
  4. CVE record — CVE-2026-93616 cve.org
  5. CISA — Known Exploited Vulnerabilities: CVE-2026-85102 cisa.gov
  6. CISA — Known Exploited Vulnerabilities: CVE-2026-93616 cisa.gov

Coverage and analysis

  1. BleepingComputer — Check Point warns of hackers exploiting Security Gateway VPN RCE flaw bleepingcomputer.com
  2. BleepingComputer — Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent bleepingcomputer.com