Check Point Flaws Under Attack; LivePatch Misses Zero-Day

Check Point's September 22, 2026 advisory confirmed active exploitation of CVE-2026-85102 in Security Gateway VPN certificate handling and CVE-2026-93616 in the Security Management web service, each rated CVSS 9.8; it also warned that LivePatch Takes 28 and 29 do not fix the management zero-day. A VPN fix had already been released, while the management fix arrived with the advisory.

The CSO report on the attacks describes the operational divide: gateways and Spark Firewalls need the VPN remedy, while management installations need a separate fix and a review of activity before it took effect. Installing a patch establishes the current software state; it cannot determine whether an exposed system was accessed earlier.

Separate gateways from management systems

CVE-2026-85102 results from improper validation of certificate data during VPN negotiation and can allow unauthenticated remote code execution. The affected product families are Security Gateway and centrally or locally managed Spark Firewall. Affected release families include R81, R81.10, R81.10.X, R81.20, R82, R82.00.X and R82.10, although exposure and the applicable fix depend on the product and installed build. Inventory VPN-enabled gateways by release, build and patch state; a management hotfix says nothing about their VPN service.

CVE-2026-93616 takes a different route: pre-authentication path traversal in the management web service can lead to script execution from an arbitrary path and Java class loading. Inventory Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent separately. Record their releases and Jumbo Hotfix takes, then establish whether the web service was reachable from the internet, a VPN segment or internal administrative networks while vulnerable. Lack of public exposure narrows one route to the service but does not settle whether a host inside the reachable network could have tried it.

Match the fix to the product and release

For the management path, the CSIRT Toscana alert lists these first fixed levels for CVE-2026-93616:

R82.20: dedicated Security Hotfix Take 1 or later.
R82.10: Jumbo Hotfix Take 45 or later.
R82: Jumbo Hotfix Take 127 or later.
R81.20: Jumbo Hotfix Take 170 or later.
R81.10: Jumbo Hotfix Take 192 or later; this branch is end of support.

Older R80 branches and R81 are also listed as affected and end of support, so plan an upgrade rather than searching for a current take on those branches. Some published affected-version ranges stop below the first fixed take shown above. If an installed take falls in that interval, do not assume it is protected: verify its exact build against the management support article, sk1000171, or obtain a product-specific answer from Check Point.

For the VPN flaw, the relevant support article is sk1000117; use its product-specific configurations, fixed builds and validation commands to select and verify the gateway or Spark remedy. The management article, sk1000171, provides its own build checks and mitigation guidance. LivePatch Takes 28 and 29 are not a substitute for the management fix. Confirm the installed release and hotfix on each instance after installation, rather than treating the presence of any update as proof that both attack paths are closed.

Review what happened before patching

The VPN investigation starts with anomalous certificate-based Mobile Access logins. Certificate subjects seen in the attacks include CN=vpn,OU=users,O=global; CN=vpn-user,OU=users,O=global; and CN=vpnuser,OU=users,O=global. The published list is incomplete, so search for unusual subjects, users and source patterns as well. Attempts were traced to anonymization infrastructure, including VPN services and proxies; an IP blocklist alone will miss changes in that infrastructure.

Follow suspicious Mobile Access sessions into the internal network. Port or service scans originating from a newly logged-in user are a relevant second-stage signal, but the absence of a scan is not a clean bill of health. Correlate authentication, gateway and network records to determine what the session actually reached. Preserve the original events and timing so a later review can distinguish an attempted login from authenticated access and subsequent activity.

On management systems, review web-service and host logs from before the correct hotfix took effect. Unexpected requests consistent with traversal, unexplained script execution or Java class loading, and subsequent administrative or policy changes all merit investigation. Use the product-specific hunting checks and indicators in sk1000171 rather than inventing a universal signature from the vulnerability description. Limited attacks had been observed before disclosure, but the public record does not establish a safe start date for searching older retained logs.

Contain any evidence of compromise

If the review indicates exploitation, preserve logs and relevant host artifacts, restrict access to the affected service and handle the system as an incident. For a VPN gateway, scope the internal services reached through suspect sessions. For a management system, inspect activity on the server and the policies and gateways it administers. The flaw's code-execution capability supports that investigation; it does not prove that an attacker changed policy in a particular deployment.

Assess whether credentials or certificates could have been exposed before deciding on rotation or replacement. Confirm that the affected service is protected by the correct build, then keep the historical compromise assessment separate from the patch check. Public reporting establishes exploitation of both flaws and available remedies, but the state of any individual environment still depends on its product, build, earlier reachability and retained evidence.