Quick recap — the scary stuff

Heads up: Check Point’s Security Management Server was hit by a zero-day that was actively abused in a small number of targeted attacks on July 23. The bug, tracked as CVE-2026-93616, is a nasty path traversal issue in the server’s web service that can let someone upload and run scripts without logging in. It was scored a whopping 9.8 on the CVSS scale.

The vendor released a proper patch for the management server on September 22. Separately, there was also a VPN-related issue (CVE-2026-85102) fixed on September 9; starting around September 12 attackers were trying to exploit that VPN flaw, mainly against small-business firewall models. The VPN attempts appeared to come via anonymizing services and proxy infrastructure.

Check Point’s public advisory doesn’t say who was targeted on July 23 or what the attackers did after gaining access, and it also doesn’t spell out every possible affected product. So treat any unpatched management server as suspect — installing the patch doesn’t retroactively tell you whether you were already compromised.

Who and what’s affected — and what to check

Affected management server builds include various R80/R81/R82 branches and several Jumbo Hotfix takes. If you run a Check Point management server, compare your release and Jumbo Hotfix take against this list and patch immediately if you’re in range:

  • R82.20 (unless updated with the posted fix)
  • R82.10 with Jumbo Hotfix Take 44 or below
  • R82 with Jumbo Hotfix Take 126 or below
  • R81.20 with Jumbo Hotfix Take 166 or below
  • R81.10 with Jumbo Hotfix Take 190 or below (end of support)
  • R81, R80.40, R80.30, R80.20, R80.10 and R80 (all end of support)

Note: LivePatch channels and regular Jumbo Hotfix takes use separate numbering; earlier LivePatch updates for other CVEs do not fix CVE-2026-93616.

For the VPN certificate flaw (CVE-2026-85102) — which affects gateways and Spark firewalls in a range of R81/R82 builds — the attacker attempts used anonymizing infrastructure and certificates with subjects that included variants like:

  • CN=vpn,OU=users,O=global
  • CN=vpn-user,OU=users,O=global
  • CN=vpnuser,OU=users,O=global

That list isn’t exhaustive. Check logs for any unusual certificate-based Mobile Access logins and follow what those sessions did after authentication (scanning internal ports and services is common).

If you already applied the September 9 VPN fixes, Check Point says you should be protected from the VPN attempts, but their advisory didn’t confirm whether any attempts actually succeeded.

What to do right now (practical checklist)

Don’t panic, but do act. If you administrate Check Point gear, do the following as soon as possible:

  1. Verify the management server’s release and Jumbo Hotfix take against the affected list above.
  2. Install the fix published for CVE-2026-93616 (management server) or the September VPN fixes for CVE-2026-85102 if you haven’t already.
  3. Use the vendor’s hunting guidance and indicators of compromise to scan the server — installing the patch won’t show whether the system was abused before the fix.
  4. Inspect Mobile Access and VPN logs for suspicious certificate-based logins and follow-up activity from any odd sessions.
  5. If you maintain gateways that can’t be patched immediately, apply available workarounds (see below) and restrict VPN traffic where possible.

Suggested temporary workaround for Site-to-Site VPN (if you can’t patch right away):

  • Disable implied VPN rules.
  • Allow UDP ports 500 and 4500 only from the specific peer IP addresses you expect traffic from.
  • Note: this workaround does not apply to locally managed Spark firewalls — treat Sparks separately.

Finally, remember that patches and LivePatch takes are different beasts — an earlier LivePatch for a different management-server CVE does not necessarily protect you from CVE-2026-93616. If in doubt, assume risk until you’ve verified your build and applied the correct update, then hunt for signs of past compromise.