Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCcriticalExploited in the wild

CISA Warns of Check Point Vulnerabilities Exploited in Attacks (CVE-2026-85102 & CVE-2026-93616)

Qualys ThreatPROTECTby Diksha Ojha ()2 min read2 · 1 read
Read at threatprotect.qualys.com
AI summary · grok-4.7Summaries by Vani AI

CISA says two critical Check Point VPN and management flaws are exploited in the wild.

CISA added CVE-2026-85102 and CVE-2026-93616 to the Known Exploited Vulnerabilities catalog and urged patching before September 25, 2026. CVE-2026-85102 (CVSS 9.8) is an authentication bypass and remote code execution flaw in Check Point Remote Access and Site-to-Site VPN caused by improper certificate validation, letting unauthenticated attackers run code on Security Gateway. CVE-2026-93616 (CVSS 9.8) is a directory traversal and file-upload bug that lets unauthenticated attackers upload and execute scripts on the Management Server. Check Point patches are available; Qualys QIDs 388806 and 388699 detect vulnerable assets.

Key facts
  • Both flaws are CVSS 9.8 and added to CISA KEV.
  • CVE-2026-85102 allows unauthenticated RCE on VPN Security Gateways.
  • CVE-2026-93616 allows unauthenticated script upload on Management Server.
  • Patch deadline cited as September 25, 2026; R82.20 fixes the VPN bug.
Analyze CVE-2026-85102 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-85102CVE-2026-93616
ATT&CK
T1190 Exploit Public-Facing Application
Tags
check-pointvpncisakevrceauthentication-bypassdirectory-traversal
Vendors
Check Point
Products
Security GatewayCheck Point Spark FirewallSecurity Management ServerRemote Access VPN
Organizations
CISAQualys

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-85102
Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw
9.854%KEVPoC
KEV
CVE-2026-93616
Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload
9.892%KEVPoC
KEV

From the original article

2 min read at threatprotect.qualys.com

Check Point has two vulnerabilities that are being exploited in the wild, tracked as CVE-2026-85102 & CVE-2026-93616. The Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerabilities to its Known Exploited Vulnerabilities Catalog, urging users to patch before September 25, 2026.

Qualys ThreatPROTECT

By Diksha Ojha · threatprotect.qualys.com

Read the full article at Qualys ThreatPROTECT

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.