Check Point Under Siege: Inside the Double Zero-Day Assault on Management Servers (CVE-2026-93616) and Gateway VPNs (CVE-2026-85102)
Date: September 23, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Zero-Day Research / Network Infrastructure Security / Threat Intelligence
Tags: Check Point, CVE-2026-93616, CVE-2026-85102, Firewalls, VPN, CISA KEV, Zero-Day, RCE
Executive Summary
Enterprise network security infrastructure is confronting an acute, dual-front crisis. On September 22–23, 2026, Check Point Software Technologies and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued emergency alerts regarding active, in-the-wild exploitation of two critical vulnerabilities spanning both Check Point's central control plane and its perimeter security appliances.
As reported by SecurityWeek, Help Net Security, and BleepingComputer, the simultaneous threat involves:
1. CVE-2026-93616 (Management Server Zero-Day): A critical path traversal and arbitrary file upload flaw residing in the Check Point Management Server web interface. The flaw allows unauthenticated remote attackers to upload and execute malicious scripts. Check Point revealed that threat actors have been stealthily exploiting this vulnerability in targeted attacks since July 23, 2026—representing an alarming two-month dwell time. Crucially, Check Point warned that standard LivePatch updates do not remediate this flaw; administrators must deploy full hotfix packages.
2. CVE-2026-85102 (Security Gateway & Spark Firewall RCE, CVSS 9.8): A pre-authentication remote code execution and authentication bypass flaw in Quantum Security Gateways and Check Point Spark Firewalls. Originating from improper validation of certificate data during Remote Access / Mobile Access VPN negotiation, the vulnerability is currently facing a coordinated, global wave of exploitation launched from anonymized proxies and commercial VPN services.
CISA immediately added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog under Binding Operational Directive (BOD) 26-04, giving federal civilian agencies a strict 72-hour deadline to remediate their environments.
Technical Deep-Dive: Two Flaws, Total Infrastructure Compromise
The combination of CVE-2026-93616 and CVE-2026-85102 represents a worst-case scenario for enterprise defense: one flaw compromises the internet-facing perimeter gateway, while the other compromises the central management server orchestrating firewall policies across the entire enterprise.t
+-----------------------------------------------------------------------------------+
| CHECK POINT DUAL INTRUSION VECTORS |
|---|+-----------------------------------------------------------------------------------+ [PERIMETER ATTACK VECTOR: CVE-2026-85102]
Unauthenticated Attacker Check Point Security Gateway / Spark
| |
| 1. Dispatches Malformed VPN Negotiation |
| [Spoofed / Injected Certificate Subject] |
|-------------------------------------------------->|
| | 2. Mobile Access Daemon (cvpnd)
| | fails to validate cert data
| | 3. Buffer overflow / Auth bypass
| |
| 4. Root RCE on Perimeter Gateway |
|<==================================================|
| 5. Pivots internally / Port scans internal LAN |
v v [CONTROL PLANE ATTACK VECTOR: CVE-2026-93616]
Unauthenticated Attacker Check Point Management Server (Gaia OS)
| |
| 1. HTTP POST to Web Management Interface |
| [Path Traversal: ../../var/www/html/evil.php]|
|-------------------------------------------------->|
| | 2. Unauthenticated File Upload
| | writes web shell to web root
| |
| 3. Accesses /evil.php |
|-------------------------------------------------->|
| 4. Executes arbitrary scripts with root rights |
|<==================================================|
| 5. Dumps all enterprise firewall policies, |
| VPN preshared keys, and admin credentials |
v v
1. CVE-2026-93616: The Management Server Path Traversal Zero-Day
The Check Point Management Server serves as the central brain of an enterprise network, managing security policies, certificate authorities, administrator accounts, and logging databases for distributed firewalls.
#### The Vulnerability Mechanism:
In affected releases of Check Point Gaia OS (R80.x through R82), the web service hosting the management API and web console contains an unauthenticated file ingestion routine.
* An external attacker sends a multipart HTTP POST request containing directory traversal sequences (`../`) within the file destination parameter.
* The web server fails to canonicalize the path before writing the file to disk.
* As a result, the attacker writes an arbitrary script (such as a PHP or Python web shell) into an unauthenticated, web-accessible directory.
* The attacker then queries the uploaded file via standard HTTP GET/POST requests, achieving arbitrary code execution with the permissions of the underlying web service (frequently root or elevated service accounts).
#### Why LivePatch Failed:
Check Point's automated LivePatch mechanism is widely relied upon by enterprise administrators because it patches running binaries in-memory without requiring service interruptions or firewall reboots. However, Check Point explicitly warned that LivePatch is structurally incapable of remediating CVE-2026-93616. Because the vulnerability involves path resolution logic within static web services and file system permissions, administrators must manually download and execute the full Jumbo Hotfix Accumulator package and restart the management daemon.
2. CVE-2026-85102: Pre-Auth VPN Certificate RCE on Spark Firewalls
While the management server flaw targets the control plane, CVE-2026-85102 targets the physical data plane. It impacts Check Point Quantum Security Gateways and Check Point Spark Firewalls—a product line heavily deployed by managed service providers (MSPs) and small-to-medium enterprises (SMBs).
#### The Vulnerability Mechanism:
When Mobile Access or Remote Access VPN is enabled, the gateway's VPN termination daemon (`cvpnd`) parses client certificates during TLS handshake negotiations.
* The parser contains an improper input validation vulnerability when extracting subject alternative names (SAN) and custom x509 extension fields.
* By presenting a crafted certificate containing malicious format strings and oversized parameters, an unauthenticated attacker bypasses authentication checks and triggers an internal memory corruption event.
* This results in immediate remote code execution inside the gateway's network daemon.
#### Telemetry on Global In-The-Wild Exploitation:
Check Point’s Vice President of Research, Lotem Finkelstein, revealed that beginning on September 12, 2026, threat actors initiated a global, coordinated wave of attacks against Spark firewall customers:
* The attacks originate almost exclusively from anonymization infrastructure (commercial VPN providers and compromised residential proxies).
* Adversaries deploy specific crafted certificate subjects (detailed in Check Point security advisories) to achieve initial execution, followed immediately by second-stage reconnaissance, including internal network port scans to identify domain controllers and database clusters.
Strategic & Industry Impact
The simultaneous exploitation of both flaws creates profound systemic risk:
1. Total Visibility for Espionage: The July 2026 dwell time for CVE-2026-93616 means sophisticated threat actors have potentially held administrative persistence inside enterprise management servers for months, allowing them to study internal network topographies, extract VPN preshared keys (PSKs), and disable logging rules undetected.
2. MSP Cascading Risk: Check Point Spark firewalls are frequently managed via central multi-tenant portals operated by Managed Service Providers. A compromised MSP Spark instance can serve as an unmonitored bridgehead into dozens of client local area networks (LANs).
3. CISA BOD 26-04 Enforcement: The 72-hour patching mandate issued by CISA underscores that federal agencies and critical infrastructure operators consider these flaws active national security threats.
Comprehensive Remediation & Threat Hunting Blueprint
Organizations utilizing Check Point infrastructure must immediately initiate emergency incident response procedures.
1. Deploy Official Standalone Hotfixes (Do Not Rely on LivePatch)
* Access the Check Point Support Center and download the specific hotfix packages for your release branch:
* For CVE-2026-93616: Apply the dedicated Management Server Hotfix (referenced in sk1000171). Ensure the installation completes successfully via Central Deployment Tool (CPUSE) or Gaia CLI.
* For CVE-2026-85102: Install the Security Gateway and Spark Hotfix (referenced in sk1000117).
* Verify that management daemons have restarted and confirm hotfix status using:
```bash
cpinfo -y all | grep -i hotfix
2. Immediate Perimeter Lockdown
* Management Server Isolation: Check Point Management Servers must never be exposed to the public internet. Ensure all ingress ports (TCP 443, 18190, 19009) are restricted strictly to private internal management VLANs or accessible only via dedicated jump boxes.
* VPN Interface Restrictions: If Mobile Access VPN is not strictly required on Spark firewalls, disable the Mobile Access blade until hotfixes are applied.
3. Forensic Threat Hunting Checklist
Security operations teams should immediately execute the following forensic queries:
* Hunt for Unauthorized Web Shells on Management Servers: Search Gaia OS web roots for newly created or modified files:
find /web/htdocs/ -name "*.php" -o -name "*.sh" -o -name "*.py" -mtime -60
find /opt/CPsuite-R*/ -name "*.jsp" -mtime -60
* Audit Mobile Access VPN Logs on Gateways: Review SmartConsole and /var/log/messages on Security Gateways for anomalous certificate-based logins originating from non-standard IP ranges.
* Detect Post-Exploitation Scanning: Inspect internal firewall logs for unexpected internal network scans (TCP port 445, 3389, 88, 389) originating directly from the internal interface of the Check Point Gateway.
For real-time vulnerability advisories, zero-day threat intelligence, and enterprise network defense strategies, subscribe to Digital Spying.