Check Point CVE-2026-85102 CVE-2026-93616 exploitation is now vendor-confirmed, changing the response from routine patching to patch verification plus compromise hunting. Check Point says CVE-2026-85102 is a pre-authentication remote-code-execution flaw in Security Gateway VPN certificate handling, while CVE-2026-93616 is a separate pre-authentication Security Management path-traversal and file-upload flaw that can lead to arbitrary script execution and Java class loading. Both are rated CVSS 9.8, fixes are available, and the two vulnerabilities affect different parts of a Check Point deployment.
Current answer: administrators should first identify whether they operate an affected gateway, Spark VPN deployment or Security Management system, then apply the exact Check Point fix for that product and release. Because exploitation has already been observed, exposed environments should also review the vendor’s hunting guidance instead of treating patch installation alone as proof that no earlier compromise occurred.
What changed in the Check Point CVE-2026-85102 CVE-2026-93616 advisory?
CVE-2026-85102 was originally disclosed and patched on September 9. Check Point said at that time that it had no evidence of exploitation. The vendor now says it observed a wave of exploitation attempts beginning September 12, particularly against Spark customers globally.
CVE-2026-93616 is a newly disclosed Security Management vulnerability. Check Point says it observed a handful of pinpointed attacks on July 23, before the vulnerability was publicly disclosed and fixed. That makes CVE-2026-93616 the true zero-day in the current advisory, while Check Point describes the later CVE-2026-85102 activity as exploitation after a fix had already become available.
CVE-2026-85102 affects gateway VPN certificate handling
CVE-2026-85102 is an improper-validation flaw in Security Gateway VPN certificate processing that can allow unauthenticated remote code execution under affected configurations. Check Point lists Security Gateway and centrally or locally managed Spark Firewall products among the affected product families.
TPS previously covered CVE-2026-85102 together with CVE-2026-85103 when Check Point first released fixes. That earlier article remains useful for the original patch disclosure: Check Point CVE-2026-85102 and CVE-2026-85103 affected versions and fixes. The new information here is that CVE-2026-85102 is now being exploited and therefore requires compromise assessment in addition to patch verification.
CVE-2026-93616 affects Security Management infrastructure
CVE-2026-93616 is a different flaw in the Check Point Management web service. Check Point says unauthenticated path traversal and file upload can allow an attacker to execute a script from an arbitrary path and load an arbitrary Java class.
The management-specific affected matrix includes R82.20, R82.10 Jumbo Hotfix Take 44 or earlier, R82 Take 126 or earlier, R81.20 Take 166 or earlier and R81.10 Take 190 or earlier, along with older end-of-support releases listed by Check Point.
Which fixes address CVE-2026-93616?
Check Point’s published remediation matrix identifies R82.10 Jumbo Hotfix Take 45 or later, R82 Take 127 or later, R81.20 Take 170 or later and R81.10 Take 192 or later as fixed states. R82.20 customers are directed to the dedicated R82.20 Security Hot Fix.
Check Point explicitly states that LivePatch Take 28/29 does not address CVE-2026-93616. Current Check Point guidance also says a LivePatch is not available for this management vulnerability, so administrators should not assume that an otherwise current LivePatch state replaces the required Security Management hotfix or Jumbo Hotfix.
Does every Check Point firewall need the CVE-2026-93616 fix?
No. CVE-2026-93616 is a Security Management vulnerability rather than a general firewall data-plane flaw. Check Point states that Quantum Force and Quantum Spark firewalls are not directly vulnerable to this management flaw and that Smart-1 Cloud has already been patched.
There is an important deployment nuance: Check Point has separately clarified that standalone deployments where management and firewall functions reside on the same device can still be affected and should be remediated. Administrators should therefore verify the actual management architecture instead of making the decision from the appliance label alone.
What should CVE-2026-85102 customers verify?
For CVE-2026-85102, customers should use the current sk1000117 matrix because exposure depends on the gateway release, build, configuration and patch path. Check Point has also documented a special case for customers that installed certain LivePatch packages manually or offline on older Jumbo Hotfix levels: those environments needed LivePatch Take 26 for enhanced CVE-2026-85102 protection.
Customers using the normal automatic LivePatch path or later applicable Jumbo Hotfix releases should follow the current vendor matrix rather than assuming the manual/offline exception applies to every deployment.
What should defenders hunt for after CVE-2026-85102 exposure?
Check Point recommends reviewing logs for anomalous certificate-based Mobile Access logins. The vendor published examples of suspicious certificate subjects observed in attacks, but explicitly warns that the list is not exhaustive.
Defenders should also look for second-stage activity associated with suspicious authenticated sessions. Check Point notes that follow-on activity can include internal port and service scanning, so investigation should extend beyond the initial VPN authentication event when credible suspicious access is found.
What should defenders check for CVE-2026-93616?
Check Point directs customers to sk1000171 for the current mitigation, hunting and indicator guidance for CVE-2026-93616. Administrators should use that controlling advisory for the latest compromise checks because the flaw affects central management infrastructure and the vendor has already observed limited exploitation.
Check Point also recommends restricting management access so TCP port 19009 is reachable only from trusted IP addresses as part of its hardening guidance. This is a defense-in-depth measure and does not replace application of the required fix.
Determine whether the asset is a Security Gateway or Spark VPN deployment relevant to CVE-2026-85102, a Security Management deployment relevant to CVE-2026-93616, or a standalone system combining management and firewall functions.
Compare the installed release, Jumbo Hotfix Take and LivePatch state with the current Check Point advisory. Do not assume one patch mechanism covers both vulnerabilities.
Install the applicable gateway protection for CVE-2026-85102 and the required Security Management hotfix or Jumbo Hotfix for CVE-2026-93616.
Review Mobile Access authentication and follow-on activity for CVE-2026-85102 and follow sk1000171’s current hunting and IOC guidance for CVE-2026-93616.
If logs or host evidence indicate unauthorized activity, preserve evidence and move the affected environment into the organization’s established incident-response process rather than treating patch installation as incident closure.
Are both vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog?
Yes. Both CVE-2026-85102 and CVE-2026-93616 were added to the Known Exploited Vulnerabilities catalog on September 22. The current federal remediation date is September 25, 2026, which creates a near-term material checkpoint for this article.
The KEV status reinforces the vendor’s active-exploitation finding. It does not establish that every exposed private-sector system was compromised, but it raises the importance of verifying patch state and performing appropriate forensic triage where exposure existed.
Are the two exploitation streams connected?
That remains unknown. Check Point confirms exploitation of both vulnerabilities but does not establish in the reviewed advisory that the same threat actor operated both campaigns. TPS found no supported actor attribution that should be presented as fact.
What remains unresolved?
The full number of compromised organizations is not established. The geography and victim set for CVE-2026-93616 remain limited in public reporting, the relationship between the two exploitation streams is unresolved, and additional indicators or post-exploitation details may emerge as Check Point and government agencies continue investigating.
What would materially change this article?
New Check Point IOCs, a revised affected-version matrix, additional LivePatch availability, confirmed victim scope, actor attribution, changes to CISA’s remediation state, newly observed post-exploitation behavior or expansion of attacks to additional product configurations would all justify an immediate same-URL update.
Verification note
TPS reviewed Check Point’s consolidated active-exploitation advisory, the vendor’s CVE-specific remediation guidance, current Jumbo Hotfix information and government exploitation guidance. The central exploitation claims and fixes are directly supported by Check Point. Actor attribution, complete victim scope and the relationship between the two attack streams remain unresolved.
Bottom line: Check Point CVE-2026-85102 CVE-2026-93616 exposure should be treated as two related but distinct operational problems. CVE-2026-85102 affects gateway and Spark VPN handling and has been exploited after a patch became available; CVE-2026-93616 affects Security Management and was exploited as a zero-day. Patch the correct product path and investigate credible pre-fix exposure rather than assuming one hotfix or one clean log check covers both vulnerabilities.
