Actively Exploited Vulnerabilities in Check Point Security Gateway and Security Management (CVE-2026-93616 and CVE-2026-85102)

THE THREAT

On September 22nd, 2026, Check Point published a security advisory disclosing two critical vulnerabilities CVE-2026-93616 (CVSS: 9.8) and CVE-2026-85102 (CVSS: 9.8), affecting its Security Gateway and Security Management products. Both vulnerabilities are pre-authentication flaws, and Check Point has confirmed active exploitation in the wild.

Successful exploitation of these vulnerabilities could allow an unauthenticated attacker to execute arbitrary code or scripts on affected systems, potentially leading to full compromise of the Security Gateway or Management Server. Fixes are available for both vulnerabilities.

As exploitation is ongoing, organizations running affected Check Point products are advised to apply the relevant patches immediately.

What We're Doing About It

• eSentire's Managed Vulnerability Service (MVS) will add relevant plugins as they become available
• eSentire customers can employ the Vulnerabilities and Inferred Vulnerabilities pages in Atlas Portal to search for potentially vulnerable assets
• eSentire's Threat Response Unit (TRU) is tracking this topic for additional information and detection opportunities

What You Should Do About It

• After performing a business impact review, apply the relevant security patches immediately
• Note that standard LivePatch updates do not resolve CVE-2026-93616; the specific Jumbo Hotfix or Security Hotfix outlined in sk1000171 must be applied
  • Refer to sk1000171 for hunting guidance and Indicators of Compromise (IoCs) published by Check Point
• For CVE-2026-85102, review logs for anomalous certificate-based Mobile Access logins and monitor for follow-up activity such as internal port and service scanning originating from suspicious logged-in users
• Contact Check Point Support if assistance is needed in assessing exposure or applying mitigations

Additional Information

CVE-2026-93616 is a newly identified zero-day affecting the Check Point Security Management Server and related management products. Check Point has confirmed a small number of targeted attacks exploiting this flaw, with the earliest observed activity dating back to July 23rd, 2026. A fix for this flaw was released as part of this advisory on September 22nd, 2026.

CVE-2026-85102 affects Check Point Security Gateway and Spark Firewall products where Site-to-Site VPN or Remote Access VPN is in use. Check Point first disclosed and patched this vulnerability on September 9th, 2026, at which time there was no evidence of exploitation. Exploitation attempts were subsequently observed beginning September 12th, targeting Spark customers globally.

At the time of writing, technical details on the vulnerabilities are limited, and there is no publicly available Proof-of-Concept (PoC) exploit code. CISA added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 25th, 2026. Given that both vulnerabilities are confirmed to be actively exploited in the wild and have been added to CISA's KEV catalog, affected organizations should treat patching as an immediate priority.

References:
[1] https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
[2] https://support.checkpoint.com/results/sk/sk1000171/
[3] https://support.checkpoint.com/results/sk/sk1000117
[4] https://www.cisa.gov/news-events/alerts/2026/09/22/cisa-adds-four-known-exploited-vulnerabilities-catalog