Check Point hacked: The security software protecting your network has become a prime attack target
Attackers are exploiting two pre-authentication Check Point firewall flaws rated CVSS 9.8.
Check Point said attackers are actively exploiting CVE-2026-85102, a pre-authentication remote code execution flaw in Spark small-business firewalls triggered by a malicious certificate during VPN negotiation, and CVE-2026-93616, a pre-authentication path-traversal zero-day in the Security Management web service that can execute scripts and load an arbitrary Java class. Both are rated CVSS 9.8. Targeted attacks on the management flaw were observed on 23 July, with a fix about two months later; the Spark bug was patched on 9 September and exploited by 12 September. Both were added to the known-exploited vulnerability catalog, and Check Point urges immediate patching plus hunts for anomalous certificate logins and internal scans.
- CVE-2026-85102 allows pre-auth RCE via a malicious VPN certificate.
- CVE-2026-93616 is pre-auth path traversal on the management service.
- Both vulnerabilities are scored CVSS 9.8.
- Spark exploitation began three days after the 9 September patch.
- Targeted management-server attacks were observed on 23 July.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85102 | Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw | 9.8 | 54% | KEVPoC | KEV |
| CVE-2026-93616 | Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload | 9.8 | 92% | KEVPoC | KEV |
From the original article
5 min read at csoonline.com
A firewall is supposed to be the barrier between attackers and the enterprise network, but that barrier can itself become a threat actors’ tool. Check Point has revealed that attackers are actively exploiting two vulnerabilities in its Security Gateway and Security Management products.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.