Check Point Software has released emergency fixes for a critical Check Point Management Server vulnerability (CVE-2026-93616) that has been exploited as far back as July 23, 2026.

The company also confirmed that a pre-authentication remote code execution (RCE) vulnerability (CVE-2026-85102) in Check Point (Quantum) Security Gateway for which it released patches on September 9, 2026, started getting probed a few days after.

“At the time [of the release of the patches], we had no evidence of exploitation. We are now observing exploitation attempts against Check Point Spark customers globally,” Lotem Finkelstein, the company’s VP of Research, revealed.

About CVE-2026-93616

CVE-2026-93616 is a pre-authentication path traversal vulnerability in the Check Point Management web service, and affects the following Check Point products: Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, SmartEvent.

Attackers may exploit it to upload and execute arbitrary scripts on the Check Point Management Server, and some already have: “Check Point is aware of a handful of customers who have been attacked.”

The vendor provided fixes for it, as well as indicators of compromise customers should look for.

Customers who cannot implement the proffered hotfixes immediately can mitigate the risk of exploitation by limiting access to their Management Servers to trusted internal IP addresses.

About CVE-2026-85102

CVE-2026-85102 is an authentication bypass and RCE flaw that affects Check Point Security Gateway. More specifically, it affects Check Point Spark Firewalls (both locally and centrally managed).

Check Point Spark is a line of next-generation firewalls aimed at small and medium-sized businesses and managed service providers.

“Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers. The attempts originated from anonymization infrastructure, including VPN services and proxies,” Check Point noted. The attempts used specific certificate subjects, outlined in the security advisory.

The company advised customers who have not yet installed the fix for CVE-2026-85102 to do so immediately, and to:

  • Review logs for anomalous certificate-based Mobile Access logins
  • Look for second stage activity originating from suspicious logged-in users via Mobile Access, e.g., internal port and service scanning

Mitigation options are available for those who cannot update their systems immediately, but only for centrally managed Spark firewalls.

Arista and F5 zero-days

Both Check Point vulnerabilities were added on Tuesday to CISA’s Known Exploited Vulnerabilities catalog, along with two additional ones exploited in zero-day attacks:

  • CVE-2026-93952, an improper input validation flaw affecting Arista VeloCloud Orchestrator, the central management platform for VeloCloud SD-WAN.
  • CVE-2026-94127, a vulnerability in F5 Networks’ BIG-IP APM (Access Policy Manager), which allows an unauthenticated attacker to send malicious network traffic to the system and perform RCE if instances are configured as an OAuth Authorization Server.

Details about the attacks have been withheld, but both vendors shared indicators of compromise.

CISA ordered US civilian federal agencies to address all four flaws by Friday (September 25) and check whether their systems have been compromised. Private sector orgs should do so, as well.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!



Source link