CVE-2026-85102 Attacks Target Spark VPNs; 93616 Needs Hotfix

Check Point Confirms CVE-2026-85102 Attacks on Spark Firewalls After the September 9 Patch​

Check Point describes CVE-2026-85102 as a pre-authentication remote code execution vulnerability in Security Gateway's VPN certificate handling. The company says it disclosed the vulnerability and released fixes on September 9, 2026. At the time, we had no evidence of exploitation. We are now observing exploitation attempts against Check Point Spark customers globally. SecurityWeek separately reports that the flaw, rated CVSS 9.8, can allow remote, unauthenticated attackers to bypass authentication and execute arbitrary code on the Security Gateway.

The advisory lists Security Gateway, centrally managed Spark Firewall and locally managed Spark Firewall as affected. Affected releases are R81 and R81.10 (both end of support), R81.10.x, R81.20, R82, R82.00.x and R82.10. According to SecurityWeek, CVE-2026-85102 affects Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN. That means your exposure depends on whether VPN is turned on, not just on the software version.

The timeline was predictable. The Dutch Nationaal Cyber Security Centrum (NCSC) warned in early September that it "assesses the likelihood of exploitation and the potential impact as high and expects exploitation attempts to occur soon", even though no public proof-of-concept (PoC) exploit has been reported at that point. Check Point says the first wave started three days after the patch shipped. It observed attacks against Spark customers starting September 12, coming from anonymizing VPN services and proxies.

The NCSC warning covered two bugs: CVE-2026-85102 and CVE-2026-85103, a heap overflow in the VPN certificate ASN.1 decoder. Check Point's exploitation report names only CVE-2026-85102 as exploited, so this article does not treat CVE-2026-85103 as part of the attack wave. Both were fixed by the same September 9 releases.

The attackers presented certificates with three subject strings:

• CN=vpn,OU=users,O=global
• CN=vpn-user,OU=users,O=global
• CN=vpnuser,OU=users,O=global

Check Point says these are only the subjects it has seen so far and that others may be in use. Treat them as a place to start searching, not as a complete blocklist.

CVE-2026-93616 Is a Separate Emergency on the Management Server​

The second vulnerability affects a different product. CVE-2026-93616 is a pre-authentication path traversal vulnerability in the Check Point Management web service that allows an attacker to execute a script from an arbitrary path and load an arbitrary Java class. (Path traversal means using sequences like ../ to reach files outside the directory a service is supposed to serve.) Check Point's support article sk1000171 also calls it a directory traversal and file-upload flaw that lets an unauthenticated attacker upload and run arbitrary scripts. It is also rated CVSS 9.8.

The scale is small. Check Point says it found a handful of pinpointed exploitation of CVE-2026-93616, and that as of the advisory publications date, we observed a handful of pinpointed attacks on July 23, 2026. BleepingComputer describes the bug as exploited as a zero-day "since July 23." The vendor's own wording points to targeted attacks on that date, not a continuous campaign. Either way, attackers had this bug roughly two months before a fix existed. The fix shipped with the September 22 advisory.

According to sk1000171, which Check Point last updated September 22, the affected products are:

• Security Management Server
• Multi-Domain Security Management Server
• Log Server
• Multi-Domain Log Server
• SmartEvent

The affected versions are:

• R82.20
• R82.10 JHF Take 44 or lower
• R82 JHF Take 126 or lower
• R81.20 JHF Take 166 or lower
• R81.10 JHF Take 190 or lower (end of support)
• R80, R80.10, R80.20, R80.30, R80.40 and R81 (all end of support)

The same article lists Smart-1 Cloud (fix already applied), Check Point Firewall Appliances and Check Point Spark Firewall as not affected.

The two flaws' exposure is almost mirrored. R82.20 was never affected by the VPN certificate bugs but is affected by CVE-2026-93616. Spark Firewall is the main target of CVE-2026-85102 attacks but is not affected by the management flaw. The minimum-take numbers also collide: R82.10 Take 44 fixes the gateway VPN flaw, yet R82.10 Take 44 or lower is still vulnerable to the management flaw. An admin who reads "Take 44" in one advisory and stops there will leave the management server exposed.

Patching CVE-2026-85102 With LivePatch Take 26, Jumbo Hotfixes and Spark Builds​

For the gateway VPN flaw, Check Point's advisory (as summarized by BleepingComputer) gives three routes, depending on the platform:

LivePatch is Check Point's mechanism for applying fixes without a full hotfix install. Arctic Wolf notes that Check Point delivered immediate patches via LivePatch (automatic for enrolled customers). SecPod's analysis adds that if automatic installation of Check Point LivePatch is enabled on R81.20, R82, or R82.10, the protection is applied automatically. LivePatch covers only those three releases, so R81.10 gateways and Spark appliances have to take the Jumbo Hotfix or Spark build.

The version number has changed since the first round. The original September fixes shipped as LivePatch Take 24. Arctic Wolf told customers then to confirm protection is active (LivePatch Take 24 or later) on all gateways and management servers. The current advisory asks for Take 26. A Check Point community notice explains why: customers who installed the offline (manual) LivePatch package and are on R82.10 JHF Take 24 or earlier, R82 JHF Take 107 or earlier, or R81.20 JHF Take 146 or earlier need Take 26 for full coverage. Customers with automatic LivePatch updates, or on a later Jumbo Hotfix, need to do nothing more in that scenario.

To check what is installed, Check Point tells administrators to run this in expert mode on the Security Gateway:

cpinfo -y CPupdates

The output lists the installed hotfixes and LivePatch state. Compare it with the table above. If you installed LivePatch by hand, confirm the take number instead of assuming the September 9 install was enough.

Temporary VPN mitigations when you cannot patch yet​

If you can't install a fix right away, Check Point's fallback is to disable the VPN implied rules (the automatic allow rules the gateway creates for VPN traffic) and replace them with explicit rules:

1. For Site-to-Site VPN, allow UDP/500 and UDP/4500 only from the specific IP addresses of your VPN peers.
2. For Remote Access VPN, allow only the services you need over UDP/500, UDP/4500, TCP/443 and TCP/80 where applicable, and limit source client IP ranges where you can.

Check Point says these mitigations do not apply to locally managed Spark firewalls. For those devices, the Spark firmware update is the only listed fix. Restricting Remote Access VPN also has limits: it can't block a user coming from an unpredictable home or mobile IP address. ThreatAft puts it bluntly: "No workarounds fully remediate the flaws — patching is the only complete remediation."

Fixing CVE-2026-93616 Requires a New Jumbo Hotfix, Not LivePatch​

The management flaw has a separate fix. According to sk1000171, fixed releases are the R82.20 Security Hotfix, or Jumbo Hotfix Accumulator R82.10 Take 45 or later, R82 Take 127 or later, R81.20 Take 170 or later, or R81.10 Take 192 or later. Each of these is at least one take above the minimum for CVE-2026-85102. A management server that met the gateway fix levels on September 9 is therefore still vulnerable.

Check Point says LivePatch Take 28/29 does not address CVE-2026-93616. It also says no LivePatch will be released for it because of the nature of the fix. Teams that rely on LivePatch for quick gateway fixes will need a maintenance window for a Jumbo Hotfix install on Security Management, Multi-Domain, Log and SmartEvent servers. sk1000171 also notes that these Jumbo Hotfixes include a fix for a third issue, CVE-2026-91843, which is not part of this exploitation report.

Until the hotfix is in, Check Point's interim mitigation is to reduce network access to the management web service:

1. Put the Management Server behind a Check Point Security Gateway.
2. Allow access to TCP/19009 only from trusted IP addresses.
3. If implied rules are enabled, limit Trusted Clients to trusted internal IPs. In SmartConsole, go to Manage & Settings > Permissions & Administrators > Trusted Clients, double-click the client you want to change, adjust its settings, and click OK.

The logic is simple: a pre-authentication bug in a management web service is only reachable by attackers who can reach the port. A management server whose TCP/19009 is reachable only from an admin network is far less exposed than one reachable from the internet. That reduces risk while you wait for the fix. It is not a substitute for the fix.

Hunting for CVE-2026-85102 and CVE-2026-93616 Compromise on Gateways and Management Servers​

Patching stops new attacks but does not undo earlier ones. The CVE-2026-85102 attacks began September 12, and the CVE-2026-93616 attacks happened in July, so check whether anything got in before your patch.

For the gateway flaw, Check Point's guidance is to review your logs for anomalous certificate-based Mobile Access logins and to not limit the search to the subjects above. It also recommends looking for activity after login, noting that second stage activity originating from suspicious logged-in users via Mobile Access often involves internal port and service scan. In practice, a certificate login from an unfamiliar subject, especially from a VPN or proxy address, followed by internal port scanning is the pattern to escalate. Check Point reports exploitation attempts. It has not said how many succeeded.

For the management flaw, sk1000171 gives two expert-mode checks for Security Management, Multi-Domain Security Management, Log, Multi-Domain Log and SmartEvent servers. The first searches the CPM log for abnormally long login usernames:

grep -nHP "login\(loginRequest=LoginRequest\{authenticationInfo=AuthenticationInfoBase\{username='[^' ]{1001,}'" "$MDS_FWDIR"/log/cpm.elg*

If that returns results, compare the timestamps with FWM or MDS core dumps:

ls -l /var/log/dump/usermode/ | grep -e fwm -e mds

Check Point says a core dump created at the same time as a matching log entry points to a potential exploitation attempt. The second check looks for failed resource-file loads:

grep -E "ERROR.*upgrade\.base\.ReflectionUtils.*Failed to load allResourceFiles map from" $MDS_FWDIR/log/cpm.elg*

Any output means a potential attempt. Look at the logged paths for traversal sequences such as ../. Check Point's own example includes a path containing ../../../../tmp/. A match on either check is a reason to investigate, not proof of compromise. Correlate hits with authentication logs, file changes and network activity from the management server before reaching a conclusion.

What This Means for Check Point Admins This Week​

Anyone running Check Point Security Gateways, Spark firewalls or Security Management infrastructure should act now. Handle it as two separate patches with two separate checks. Spark customers with VPN enabled are the most urgent group, since that is where Check Point sees broad, global attempts. Management servers come next. The attacks there were few and targeted, but the flaw was exploited as a zero-day and cannot be fixed with LivePatch.

CISA added both CVEs to its Known Exploited Vulnerabilities catalog on September 22 and said it was CVE-2026-85102 Check Point Multiple Products Improper Certificate Validation Vulnerability · CVE-2026-93616 Check Point Multiple Products Path Traversal Vulnerability. BleepingComputer reports a September 25 remediation deadline. That deadline binds only US federal civilian agencies under Binding Operational Directive (BOD) 26-04. For everyone else, it is a sensible target to aim for.

• Run cpinfo -y CPupdates on every Security Gateway. Confirm LivePatch Take 26 or the fixed Jumbo Hotfix take, especially if you installed the offline LivePatch package manually.
• Update Spark appliances to R82.00.10 Build 2325 or R81.10.17 Build 4968 or later. The VPN implied-rule workaround does not protect locally managed Spark firewalls.
• Patch management, log and SmartEvent servers separately for CVE-2026-93616, to R82.10 Take 45, R82 Take 127, R81.20 Take 170, R81.10 Take 192 or the R82.20 Security Hotfix. Don't count on LivePatch for this one.
• Limit TCP/19009 on management servers to trusted IPs until the hotfix is installed, and tighten SmartConsole Trusted Clients if implied rules are on.
• Search Mobile Access logs back to September 12 for unusual certificate-based logins and internal scanning, and run the two cpm.elg checks on management servers back to at least July.
• Plan to move off end-of-support releases such as R80.x, R81 and R81.10. They appear in the affected lists for both flaws.

The gap between the September 9 fix and the September 12 attacks was three days. For a pre-authentication bug on an internet-facing VPN, that is roughly how long defenders now get. The management flaw was exploited for two months before any patch existed. Organizations that installed the September 9 fix still need the management Jumbo Hotfix and a log review before they can consider their Check Point deployment clean.