Author: DigitalSpying Security Desk
Date: September 22, 2026
Executive Summary
In a major security alert reflecting intense threat actor activity against enterprise network perimeters, Check Point Software Technologies has confirmed that a previously undisclosed vulnerability in its Security Management Server was actively exploited as a zero-day in targeted attacks. Tracked as CVE-2026-93616 and rated 9.8 out of 10.0 on the CVSS scale, the flaw allows an unauthenticated, remote attacker to exploit a path traversal defect in the server’s web service to upload and execute arbitrary scripts without logging in.
Compounding the crisis, Check Point simultaneously disclosed that threat actors have been actively attempting to exploit another vulnerability, CVE-2026-85102, against Check Point Security Gateways and small-business Spark firewalls since September 12. Threat actors are routing traffic through anonymizing proxies and presenting forged digital certificates to exploit a defect in VPN certificate validation. Because the newly disclosed management server zero-day is distinct from the pre-authentication stack overflow (CVE-2026-91843) patched just days prior, administrators who deployed recent updates may still remain vulnerable unless they apply the latest hotfixes published in support bulletins sk1000171 and sk1000117.
Deep-Dive Technical Analysis
1. Vulnerability 1: The Management Server Zero-Day (CVE-2026-93616 — CVSS 9.8)
Check Point’s Security Management Server compiles, manages, and distributes security policies across thousands of connected gateway appliances:
* The Path Traversal Defect (CWE-22): The vulnerability originates in the management server’s HTTP/HTTPS web service. When handling incoming file upload requests, the application fails to properly validate and constrain requested directory paths.
* Unauthenticated Script Execution: An attacker who has network connectivity to the management server’s web interface can transmit crafted requests containing directory traversal sequences (../) to upload executable script files directly into server directories. The attacker can then invoke those scripts over the network, achieving remote code execution with the permissions of the management daemon without presenting authentication credentials.
* Confirmed In-The-Wild Exploitation: Check Point confirmed that threat actors actively weaponized this flaw in a "handful of targeted attacks" on July 23, 2026, underscoring that adversaries possessed working zero-day exploit capabilities months before public disclosure.
+----------------------------------------------------------------------------------------------------+
| CHECK POINT DUAL-THREAT ATTACK VECTORS |
|---|
[VECTOR A: Management Server Zero-Day (CVE-2026-93616)]
Unauthenticated Attacker ---> Sends Traversal Upload Request to Management Web Service (CWE-22)
|
v
Uploads & Executes Arbitrary Script on Management Server (CVSS 9.8)
|
[Total Seizure of Central Enterprise Firewall Policies]
----------------------------------------------------------------------------------------------------
[VECTOR B: Active VPN Gateway Exploits (CVE-2026-85102)]
Attacker via Proxies ---> Connects to Spark / Quantum Gateway VPN Port (Site-to-Site / Mobile Access)
|
v
Presents Forged Certificate (CN=vpn, CN=vpn-user, OU=users, O=global)
|
Bypasses Certificate Validation -> Achieves Code Execution on Gateway
|
[Internal Subnet Port Scanning & Lateral Network Infiltration]
2. Vulnerability 2: Active VPN Attacks on Spark & Quantum Gateways (CVE-2026-85102)
While the management server flaw enables central policy compromise, the active campaign against Check Point gateways targets the operational perimeter:
* VPN Certificate Validation Bypass: CVE-2026-85102 resides in the routine that validates digital certificates during VPN tunnel establishment on Quantum Security Gateways and Spark firewalls. The flaw permits an unauthenticated attacker to execute code on the gateway.
* Active Attack Signatures: Since September 12, 2026, threat actors have deployed automated exploitation tools routing through commercial VPNs and anonymizing proxies. Check Point identified specific client certificate subjects utilized in active intrusions:
* CN=vpn,OU=users,O=global
* CN=vpn-user,OU=users,O=global
* CN=vpnuser,OU=users,O=global
* Post-Exploitation Triage: Once authenticated via the compromised Mobile Access portal, attackers immediately initiate internal network port scanning to locate and target high-value domain controllers and database clusters.
3. The Take-Number Patch Trap: Why Previous Updates Left You Exposed
A critical challenge for Check Point administrators is navigating the vendor's "Jumbo Hotfix Take" release numbering:
* On September 16, Check Point patched a different management server flaw, CVE-2026-91843 (a stack overflow), via LivePatch.
* However, the affected version ranges for the newly disclosed CVE-2026-93616 extend one Take higher than the September 9 and September 16 updates on R82.10, R82, and R81.20.
* Consequently, servers updated solely to remediate the earlier flaws remain fully vulnerable to CVE-2026-93616. Administrators must explicitly install the hotfixes specified in support article sk1000171.
4. Comprehensive Vulnerability Comparison Matrix
Threat Domain
Management Zero-Day (CVE-2026-93616)
Gateway VPN Campaign (CVE-2026-85102)
Component
Security Management Server Web Service
Quantum Security Gateway / Spark Firewalls
Vulnerability Class
Path Traversal Script Execution (CWE-22)
Improper Certificate Validation
CVSS v3.1 Score
9.8 (Critical)
High / Critical
Exploitation State
Exploited in Targeted Zero-Day Attacks
Active In-The-Wild Exploitation since Sept 12
Remediation Advisory
Check Point Advisory sk1000171
Check Point Advisory sk1000117
Industry Impact: Securing the Firewall Infrastructure
The simultaneous compromise of edge gateways and central management servers represents a severe organizational emergency:
* Double-Sided Vulnerability: Threat actors can target perimeter gateways via VPN certificate flaws to establish an initial foothold, while simultaneously targeting management servers via web path traversal to disable logging and alter enterprise-wide security rules.
* The Small Business Spark Target: The active campaign against Spark appliances demonstrates that threat actors specifically seek out small-to-medium business (SMB) firewalls, which frequently lack dedicated 24/7 SOC monitoring.
Strategic Recommendations & Actionable Defenses
1. Deploy sk1000171 Hotfixes on Management Servers Immediately
* Verify the active Jumbo Hotfix Take on all Security Management Servers and Multi-Domain Management (MDM) platforms. Apply the required build from support article sk1000171.
* For R82.20 deployments, contact Check Point Support immediately to obtain the required hotfix package.
2. Remediate VPN Gateways via sk1000117
* Ensure all Quantum and Spark gateways have applied the fixes in sk1000117.
* Temporary Workaround for Gateways: If an immediate patch is impossible, turn off implied VPN rules and restrict UDP ports 500 and 4500 strictly to explicitly permitted peer IP addresses.
3. Threat Hunting & Certificate Log Auditing
* Inspect gateway VPN and Mobile Access logs for incoming connections bearing certificate subjects matching CN=vpn* and O=global.
* Audit management server file systems for unrecognized scripts written to web-accessible directories, and verify that management interfaces are strictly firewalled from public internet access.