CISA Adds Multiple Check Point Product Flaws to Exploited Vulnerabilities List
CISA added two actively exploited Check Point flaws, including unauthenticated VPN code execution, to KEV.
CISA added CVE-2026-85102 and CVE-2026-93616 to the KEV catalog on September 22, 2026, warning both are actively exploited, with a federal deadline of September 25 under BOD 26-04. CVE-2026-85102, CVSS 9.8, is improper certificate validation in Check Point Quantum Security Gateway and Spark Firewall VPN configurations, allowing an unauthenticated attacker to execute arbitrary code during VPN negotiation. CVE-2026-93616 is a path traversal in Security Management Server, Multi-Domain Security Management, log servers, and SmartEvent that allows unauthenticated upload and execution of arbitrary scripts. Both entries require forensic triage. CISA has not linked either flaw to ransomware.
- Both Check Point flaws are in CISA's KEV catalog and actively exploited.
- CVE-2026-85102 is CVSS 9.8 unauthenticated VPN remote code execution.
- CVE-2026-93616 lets attackers upload and run scripts on management servers.
- Federal civilian agencies face a September 25, 2026 remediation deadline.
- CISA requires forensic triage; ransomware use is not identified.
- Vendors
- Check Point
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85102 | Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw | 9.8 | 54% | KEVPoC | KEV |
| CVE-2026-93616 | Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload | 9.8 | 92% | KEVPoC | KEV |
From the original article
2 min read at gbhackers.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities affecting multiple Check Point products to its Known Exploited Vulnerabilities (KEV) catalog.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.