Check Point Issues Urgent Fixes for Zero-Day Flaw Exploited in Targeted Attacks and Active VPN Targeting

Cybersecurity researchers and software providers have been placed on high alert following revelations that attackers exploited a previously unknown zero-day vulnerability within Check Point’s Security Management Server during a wave of targeted attacks earlier this year. According to official advisories issued by Check Point, the sophisticated exploitation took place on July 23, catching organizations off guard before the underlying flaw could be identified and patched. The incident highlights the persistent and evolving threat landscape facing enterprise infrastructure management systems, which remain high-value targets for advanced threat actors looking to gain deep, unauthorized access to corporate networks and critical security controls.

The newly disclosed vulnerability, formally tracked as CVE-2026-93616, is classified as a severe path traversal bug residing within the web service component of Check Point’s Security Management Server. This critical administrative product is responsible for controlling firewall policies across the broad spectrum of Check Point gateways deployed within enterprise environments. Due to improper input validation and insufficient constraints on which files and folders can be reached by incoming web requests, the vulnerability allows an unauthenticated remote attacker who has network access to the server’s web service to execute arbitrary scripts directly on the underlying system without needing to provide valid login credentials.

Given the profound implications of unauthorized script execution on a central security management console, Check Point assigned the vulnerability a maximum severity rating of 9.8 out of 10 on the Common Vulnerability Scoring System (CVSS) scale. Security analysts emphasize that management servers represent the crown jewels of network architecture, as compromise of these platforms often grants adversaries the ability to alter firewall rules, intercept sensitive traffic, disable security logging, or pivot deeper into corporate networks. Although Check Point moved to release an official software fix and comprehensive mitigation guidance on September 22, the company’s initial advisory indicated that the July attacks were highly targeted in nature. At the time of reporting, the vendor has not publicly identified the specific victims, the threat actors responsible, or the exact scope of malicious activity conducted after the vulnerability was successfully triggered.

Compounding these concerns, Check Point revealed that malicious actors have also been actively attempting to exploit a separate, highly critical VPN flaw since September 12. This secondary campaign targets a vulnerability tracked as CVE-2026-85102, which Check Point originally patched on September 9. The ongoing exploitation attempts have predominantly targeted customers utilizing Spark, Check Point’s specialized line of firewall appliances tailored for small and medium-sized businesses. Significantly, when the initial patch was released earlier in September, the vendor stated there was no active evidence indicating that CVE-2026-85102 was being actively exploited in the wild. The sudden shift toward active exploitation underscores the rapid weaponization of security flaws by opportunistic or targeted cybercriminal groups shortly after patches become publicly available.

Management Server Versions and Fixes

The discovery of CVE-2026-93616 has prompted extensive administrative reviews across global IT departments, particularly regarding the complex versioning and hotfix systems utilized by Check Point. The vendor traditionally numbers its Jumbo Hotfix updates for each software release by specific iterations known as "Takes," while utilizing a separate LivePatch channel to push out urgent, out-of-band security fixes. Navigating these release structures requires precise attention from system administrators to ensure that servers are fully immunized against cumulative threats without disrupting established operational workflows.

In its official documentation, Check Point outlined the affected management server builds and provided detailed remediation protocols, indicators of compromise, and threat-hunting instructions housed within support article sk1000171. The complexity of patching these systems is further heightened by recent security history. For instance, on September 16, Check Point released a separate urgent patch for another management server vulnerability, CVE-2026-91843, delivered via the LivePatch channel as LivePatch Take 28, or Take 29 specifically for the R82.20 release. According to summaries provided by external advisory bodies such as France’s CERT Santé, those specific LivePatch takes did not incorporate a fix for the newly disclosed path traversal flaw, meaning administrators who applied only the mid-September patch remain vulnerable unless they apply the subsequent comprehensive updates.

Furthermore, the cascading nature of recent software updates has created potential pitfalls for patch management teams. CVE-2026-8503, an associated VPN certificate vulnerability patched alongside other issues on September 9, affected both security gateways and management servers across multiple versions, including R81.20, R82, and R82.10. For several of these releases, the affected version threshold for the newer management flaw extends one take higher than the previous vulnerability. Consequently, a server that was updated just enough to clear the September 9 security threshold may still be exposed to CVE-2026-93616 unless it has been brought up to the latest specified build level. Security experts strongly advise administrators to meticulously cross-reference their current Jumbo Hotfix levels with the exact parameters outlined in Check Point’s technical support documentation to ensure complete coverage.

Spark Firewalls Targeted Through VPN Flaw

The separate campaign targeting CVE-2026-85102 involves deep-seated mechanics within the way Check Point gateways process and validate digital certificates during the establishment of virtual private network connections. The vulnerability affects both centrally managed Security Gateways and locally managed Spark firewalls running on vulnerable software versions spanning R81 through R82.10. According to warnings issued by international cybersecurity authorities, including the Netherlands’ National Cyber Security Centre (NCSC), the flaw is triggered specifically when these products are configured to utilize Site-to-Site VPN or Remote Access VPN services, potentially allowing unauthenticated remote code execution on the affected gateway appliances.

Investigation into the recent exploitation attempts against Spark firewalls revealed that attackers are heavily relying on anonymizing infrastructure, including commercial VPN services and intermediate proxy networks, to obscure their true origins. Threat intelligence gathered by Check Point indicates that the malicious connection attempts have utilized certificates carrying specific subjects. However, security analysts warn that this indicator list is non-exhaustive and that attackers are likely rotating infrastructure and modifying certificate parameters to evade signature-based detection mechanisms.

Because of this evasion tactic, network administrators are urged to expand their log reviews beyond simple alerts matching known malicious certificate subjects. Security teams should perform thorough forensic audits of Mobile Access login logs to identify unusual patterns, unauthorized authentication attempts, or suspicious post-compromise behavior. Historical data from similar incidents indicates that once adversaries establish a foothold via VPN vulnerabilities, their subsequent actions often include internal network reconnaissance, port scanning, and attempts to map out internal enterprise services for lateral movement.

While Check Point has confirmed that customers who successfully deployed the September 9 patches are shielded from CVE-2026-85102, the vendor’s advisories have not explicitly detailed whether any of the post-patch exploitation attempts succeeded in compromising customer environments. For organizations that find themselves unable to immediately apply the official software patches due to operational constraints, alternative mitigations have been made available. The NCSC and Check Point have recommended specific workarounds for Site-to-Site VPN deployments, such as disabling implied VPN rules and strictly restricting UDP ports 500 and 4500 to trusted, pre-approved peer IP addresses. However, administrators are reminded that these temporary workarounds may not apply universally, particularly to locally managed Spark firewalls, making the application of vendor-supplied patches the only comprehensive long-term defense against active exploitation.