Patch Check Point gateways and management servers: two flaws are being exploited
CISA added two critical Check Point flaws on September 22, one in VPN gateways and one in management servers. LivePatch covers the VPN flaw but not the management server flaw.
If you run Check Point firewalls, two separate critical vulnerabilities need attention, and they’re fixed in different ways. CISA added both to its Known Exploited Vulnerabilities catalog on September 22, 2026.
1. VPN gateways: CVE-2026-85102
What it is: improper validation of certificate data during VPN negotiation can let an unauthenticated remote attacker run code on the Security Gateway. CVSS 9.8.
Who’s affected: Security Gateways and Spark Firewalls using Remote Access VPN, or Site-to-Site VPN with certificate-based authentication. Check Point notes that gateways using only pre-shared-key authentication for site-to-site VPN aren’t vulnerable. Affected versions include R81.20, R82, R82.10, R81.10.x, and R82.00.x, plus end-of-support R80 through R81.10. R82.20 is not affected.
Exploitation: Check Point reports active exploitation on Spark Firewalls as of September 12.
The fix:
- Check Point LivePatch (take 26) for R82.10, R82, and R81.20. If automatic LivePatch installation is on, the protection is applied automatically.
- Or the Jumbo Hotfix Accumulator: R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+, R81.10 Take 190+.
- Spark Firewalls: R82.00.10 Build 2325+ or R81.10.17 Build 4968+.
Check for signs of attack: in the Logs & Monitor view, search for certificate-based Mobile Access logins after September 12 (product: "Mobile Access" AND action: "Log In" AND "Certificate") and look for unrecognized users or source addresses. Check Point’s advisory lists suspicious certificate names seen in attacks so far.
2. Management servers: CVE-2026-93616
What it is: a directory traversal and file upload flaw that lets an unauthenticated attacker upload and run scripts on the Check Point management server. CVSS 9.8. Check Point says it’s exploited in the wild, with a handful of customers attacked.
Who’s affected: Security Management Servers, Multi-Domain Management Servers, Log Servers, Multi-Domain Log Servers, and SmartEvent. Not affected: Smart-1 Cloud (already fixed), firewall appliances, and Spark Firewalls.
LivePatch does not fix this one. You must install a hotfix.
The fix:
- R82.20: the R82.20 Security Hotfix
- Jumbo Hotfix Accumulator: R82.10 Take 45+, R82 Take 127+, R81.20 Take 170+, R81.10 Take 192+
Until you can patch: make sure management servers sit behind a Check Point gateway, and that TCP port 19009 is reachable only from trusted IP addresses. In SmartConsole, confirm Trusted Clients (Manage & Settings > Permissions & Administrators > Trusted Clients) are limited to trusted internal addresses.
Check for signs of attack: Check Point’s advisory includes two log searches to run in Expert mode on every management, log, and SmartEvent server.
Sources
- sk1000117: CVE-2026-85102, authentication bypass and remote code execution in Remote Access and Site-to-Site VPN (Check Point): affected versions, LivePatch and Jumbo Hotfix fixes, exploitation on Spark Firewalls, and indicators of attack
- sk1000171: CVE-2026-93616, directory traversal and file upload on the Management Server (Check Point): affected products, fixes, mitigation, and indicators of compromise
- Known Exploited Vulnerabilities catalog (CISA): both added September 22, 2026
Get new guides by email
Plain-English tech tips, scam and security alerts, and fixes for small offices, whether you're the office manager or the IT pro. No spam, and you can unsubscribe anytime.