Check Point has released emergency patches for two separate vulnerabilities in its network security products, one of which was already being used against a small number of customers before a fix existed. Both flaws carry the maximum severity score of 9.8 out of 10, and both allow an attacker to act without ever needing a username or password.
The more urgent of the two, tracked as CVE-2026-93616, is a path traversal vulnerability in the web service that runs on Check Point’s Security Management Server. This is the console administrators use to configure and control every firewall and gateway on their network, so a successful attack against it can hand an intruder control over far more than a single device. Check Point said the flaw lets an unauthenticated attacker reach arbitrary files on the server and load a malicious Java class, which in practice means they can run their own code on the machine. The vulnerability also affects Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent deployments.
Check Point said it first spotted the flaw being used in “a handful of pinpointed attacks” on July 23, 2026, and released a fix, the R82.20 Security Hotfix, on September 22. The company has not named the attackers or said which organizations were targeted. Affected versions include R82.20, R82.10 with Jumbo Hotfix 44 or earlier, R82 with Jumbo Hotfix 126 or earlier, R81.20 with Jumbo Hotfix 166 or earlier, and older releases still under support.
The second vulnerability, CVE-2026-85102, sits in a different part of the product line. It involves improper validation of certificate data during VPN negotiation, and it allows an unauthenticated attacker to execute code remotely on Security Gateway and Spark Firewall devices, both in centrally and locally managed setups. Check Point disclosed this one on September 9 and had patches ready immediately, but that has not stopped attackers from trying. The company says exploitation attempts against Spark firewall customers began around September 12, using VPN logins built around suspicious certificate subjects. The Dutch National Cyber Security Centre, NCSC-NL, has also warned that it expects broader exploitation attempts to follow.
For organizations that cannot patch immediately, Check Point has published temporary mitigations. For the management server flaw, that means placing the server behind a firewall and tightening the Trusted Clients setting in SmartConsole so only approved administrator machines can reach it. For the VPN certificate flaw, the company is telling customers to check logs for anomalous certificate-based logins and any signs of activity following a login. Full guidance and hunting indicators are available through Check Point’s support portal, under reference sk1000171 for the management server issue and sk1000117 for the VPN issue.
It’s worth noting that several older releases, including R81.10, R81, and the entire R80.x line, are listed as end of support. Those versions will not receive a patch, so organizations still running them are exposed regardless of how quickly they act, and should treat migration to a supported release as the real fix.
Security management consoles and VPN gateways sit at a point in the network where a single compromise can cascade outward, since they are trusted by design to reach and reconfigure everything downstream. That is what makes this pair of disclosures worth acting on quickly rather than filing away for the next maintenance window.
Sources: Check Point security advisory, The Hacker News, and BleepingComputer.
