Check Point CVE-2026-93616 & 85102: 9.8 Pre-Auth RCEs Exploited

Two flaws in Check Point's own security gear are being used in live attacks, and the pair says more together than either does alone. One is a pre-authentication hole in the Security Management server, the box that pushes policy to every gateway you run. The other reaches code execution on a VPN gateway during connection setup, again with no login. Both score 9.8. Both landed on CISA's must-patch catalog on September 22 with a September 25 deadline. Patching closes the door. It does not tell you who already walked through, and on one of these, someone has had two months.

What each flaw actually gives an attacker

CVE-2026-93616 sits in the Security Management web service and needs no login to fire. The web service can be steered outside its intended directory, so an unauthenticated caller can drop a script, run it, and load a Java class straight onto the management server. That server is the control plane for your firewall estate. It holds policy, certificates, and the trust every managed gateway obeys. Code execution there is not one device, it is the keys to all of them. It affects Security Management on R80 through R82.20 running hotfix takes at or below the levels Check Point lists, for example R82.10 at Jumbo Hotfix Take 44 or lower and R82 at Take 126 or lower. The fix shipped with the September 22 advisory; sk1000171 carries the exact takes.

CVE-2026-85102 is a certificate validation flaw. During VPN negotiation the gateway does not properly check certificate data, and that gap reaches unauthenticated remote code execution. It affects Security Gateway and Spark firewalls on R81 through R82.10 that have Site-to-Site VPN or Remote Access VPN turned on. Check Point shipped this fix earlier, on September 9. The exploitation attempts that followed used certificates with three specific subjects, all sent from anonymization services and proxies.

The two windows are the whole point

CVE-2026-93616 was hit as a zero-day starting July 23, roughly two months before a fix existed or the CVE was public. Check Point is blunt about the catch: applying the patch cannot reveal whether the box was already broken into. CVE-2026-85102 is the mirror image. The fix was public on September 9, and exploitation attempts started September 12. Three days. One flaw shows how long an appliance bug can burn in silence; the other shows how fast a disclosed one gets weaponized. If your plan is "we patched, we are fine," you have answered only the second story.

Why patching is step one, not the finish

CISA did not only set a deadline. Its required action names a forensics triage requirement, not just a patch. That is the tell. The agency treats a management-server compromise as something you have to investigate, because the fix is silent about the past. Treat both boxes as assume-breach until you have looked. For the gateway, the published indicators are concrete: certificate-based Mobile Access logins using the subjects below, followed by second-stage activity from those sessions. For the management server, Check Point's sk1000171 carries the hunting guidance and indicators. Work it before you close the ticket.

Malicious VPN certificate subjects seen in attacks:
  CN=vpn,OU=users,O=global
  CN=vpn-user,OU=users,O=global
  CN=vpnuser,OU=users,O=global
Review your gateway logs for:
  certificate-based Mobile Access logins matching the subjects above
  second-stage activity from those logged-in Mobile Access users
  connection attempts arriving from VPN and proxy anonymization services

Your perimeter stack is the KEV pipeline now

Check Point did not reach the exploited-vulnerabilities catalog alone on September 22. F5 BIG-IP APM and Arista's VeloCloud Orchestrator went on the same day. Step back a few weeks and the shape repeats: Cisco ASA and FTD, Cisco's firewall management software, Fortinet session handling. The device you bought to inspect traffic at the edge has become one of the most dependable ways in. It sits unauthenticated on the internet by design, it rarely runs an endpoint agent, and its logs often live only on the box. That combination is exactly why these bugs run for months before anyone notices. We wrote up a separate Check Point SmartConsole flaw not long ago; this is the same theme, one layer deeper into the stack.

What to do now

The order matters, because the fix does not clean up after an intrusion it cannot see.

• Patch both. For CVE-2026-85102, move to a fixed take on R81.10.x, R81.20, R82.00.x, or R82.10 per sk1000117. For CVE-2026-93616, apply the management hotfix take above the vulnerable levels per sk1000171.

• Use the workaround if you cannot patch the gateway today. For Site-to-Site VPN, Check Point's interim step is to disable implied rules and allow UDP 500 and 4500 only from known peer IP addresses. It narrows exposure; it is not a substitute for the fix.

• Hunt before you close. Run the indicators in sk1000171 on the management server and check gateway logs for the certificate subjects above. Nothing about the patch does this for you.

• Do not trust a LivePatch status here. Check Point notes that LivePatch Take 28/29 does not address CVE-2026-93616, so a green LivePatch line is not a fix for the management flaw.

The management-server bug is the one to lose sleep over. A gateway compromise is bad; a management-server compromise is your whole policy, your certificates, and your fleet of gateways in someone else's hands. Patch the gateway first because it is faster, then give the management box the forensic attention its two-month head start earned.