Check Point patches a Security Management zero-day it saw exploited on July 23
The advisory confirming attacks on a Security Gateway VPN flaw three days after its September 9 fix also carries the first patch for a management path traversal that was used in targeted attacks in late July.
The Watch · Security desk
What happened
- Check Point Research says it is seeing exploitation attempts worldwide against Spark customers aimed at CVE-2026-85102, a pre-authentication remote code execution bug in Security Gateway VPN certificate handling.
- Check Point says a handful of pinpointed attacks using the management flaw took place on July 23, 2026, when it was still an undisclosed zero-day.
- The gateway attempts came through VPN services and proxies and used client certificates with subjects including CN=vpn,OU=users,O=global, a list Check Point says is not exhaustive.
Why it matters
- Who has to decide decision Anyone who closed a Check Point patching ticket in September has a second one to open, on a different box: the gateway hotfix leaves the management web service unfixed.
- Who's exposed exposure Spark operators who deferred the September 9 fix to a maintenance window are now being probed from proxy and VPN infrastructure.
- What it sets up precedent With the management flaw used before it was known, log retention decides whether a compromise from late July is findable at all.
Next story · Security · 10h ago
CISA adds Atlassian Data Center flaw CVE-2026-21589 to its exploited-vulnerabilities listConfirmed2 publishers
Neither bug needs credentials. CVE-2026-85102 gets code execution on a Security Gateway through VPN certificate handling [1]. CVE-2026-93616 lets an attacker execute a script from an arbitrary path and load an arbitrary Java class through the Check Point Management web service [8].
They sit on different boxes, so they need different tickets. A gateway that took the September 9 hotfix is protected against 85102, according to Check Point [5]. That hotfix does not touch the management server, which needs the fix released with this advisory [8].
The advisory's own heading calls 85102 "One day exploitation, patch available since September 9" [3]. The wave it then describes against Spark customers starts September 12, three days after the fix shipped [7][15]. Attempts arrived through VPN services and proxies and used client certificates with the subjects CN=vpn, CN=vpn-user and CN=vpnuser, all under OU=users and O=global [9]. Check Point says those are only the subjects observed so far and that other subjects may be in use [10].
The management flaw is the older incident. Check Point dates the pinpointed attacks to July 23, 2026, and the fix arrives with this advisory, published on or after the September 12 gateway wave it reports [6][7]. Counting July 23 to September 12 gives at least 51 days in which the flaw was in use with no fix available [16]. A hunt on the management server therefore begins in late July, and the indicators are in sk1000171 [13].
For the gateway, the guidance is log work: review anomalous certificate-based Mobile Access logins, and do not limit the search to the three published subjects [11]. Then look at what those accounts did next. Follow-up activity often involves internal port and service scanning, according to Check Point [12].
The advisory body does not list affected takes and builds; Check Point puts those, with validation commands and alternative mitigation steps, in the per-product advisories it links [14]. Both fixes ship as Jumbo hotfixes, which Check Point releases under what it calls its Frontier AI Readiness Program [17]. Spark is the customer set it names for the observed 85102 attempts, and it describes that activity as global [2].
What to watch
- Whether Check Point reports CVE-2026-85102 exploitation against gateway lines other than Spark.
- Whether the certificate subject list or the sk1000171 indicators are expanded, or an actor is named for the July 23 attacks.
- Whether the handful of pinpointed CVE-2026-93616 cases grows once customers start hunting back to late July.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+5
- Incentives60
- Confidence70
Perspective Coverage
6 publishers- Builder
- Builder 21%
- Operator
- Operator 70%
- Investor
- Investor 9%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-85102 is a pre-authentication remote code execution vulnerability in Check Point Security Gateway's VPN certificate handling.
- [2]
Check Point Research says it is observing exploitation attempts against Check Point Spark customers globally for CVE-2026-85102.
- [3]
Check Point disclosed CVE-2026-85102 and released fixes on September 9, 2026, and said it had no evidence of exploitation at that time; the advisory section heading reads "CVE-2026-85102: One day exploitation, patch available since September 9".
- [4]
Check Point describes CVE-2026-93616 as a newly discovered zero-day vulnerability in Security Management with limited, pinpointed exploitation.
- [5]
Check Point says customers who have applied the fix for CVE-2026-85102, available since September 9, are already protected.
- [6]
Check Point says that as of the advisory publication date it had observed a handful of pinpointed attacks using CVE-2026-93616 on July 23, 2026.
- [7]
Check Point says that starting September 12, 2026 it observed a wave of exploitation attempts against Spark customers using CVE-2026-85102.
- [8]
CVE-2026-93616 is a pre-authentication path traversal vulnerability in the Check Point Management web service that allows an attacker to execute a script from an arbitrary path and load an arbitrary Java class; a fix is available with the advisory.
- [9]
The CVE-2026-85102 attempts originated from anonymization infrastructure including VPN services and proxies, and used certificates with the subjects CN=vpn,OU=users,O=global; CN=vpn-user,OU=users,O=global; and CN=vpnuser,OU=users,O=global.
- [10]
Check Point says the observed certificate subject list is not exhaustive and other certificate subjects may be in use.
- [11]
Check Point advises reviewing logs for anomalous certificate-based Mobile Access logins and not limiting the search to the certificate subjects it published.
- [12]
Check Point says follow-up activity from suspicious users logged in via Mobile Access often involves internal port and service scanning.
- [13]
Check Point refers customers to sk1000171 for mitigation, hunting and indicators of compromise for CVE-2026-93616.
- [14]
The advisory says full details, including affected configurations, exact takes and builds, validation commands, alternative mitigation steps and upgrade guidance, are in the linked product advisories.
- [15]
The observed exploitation wave against Spark customers began three days after the CVE-2026-85102 fix was released.
- [16]
At least 51 days passed between the pinpointed CVE-2026-93616 attacks of July 23, 2026 and the advisory that carries the fix, since that advisory reports activity dated September 12, 2026 and is therefore published on or after that date.
- [17]
Check Point says it releases Jumbo hotfixes with security fixes and hardening improvements for its Firewall and Management products as part of its Frontier AI Readiness Program.
Sources
6 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comCheck Point warns of Management Server zero-day exploited in attacks
2 articles · September 23, 2026
- blog.checkpoint.comSecurity Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616
1 article · September 22, 2026
- helpnetsecurity.comAttackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances
1 article · September 23, 2026
- securityaffairs.comCheck Point Fixes a New Actively Exploited Critical Security Flaw
1 article · September 22, 2026
- securityweek.comCheck Point Patches Exploited Management Server Zero-Day
1 article · September 22, 2026
- thehackernews.comCheck Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
2 articles · September 23, 2026
Topics and entities
Topics
- VPN gateway security
- Known Exploited Vulnerabilities catalog
- Zero-Day Exploitation
Entities
- Check Point Research
- Check Point Security Management Server
- CVE-2026-85102
- Lotem Finkelstein
- Check Point Spark Firewall
- Check Point Software Technologies
- CISA
- Netherlands National Cyber Security Centrum
- CVE-2026-93616