Check Point has released emergency fixes after confirming active exploitation of two critical, pre-authentication vulnerabilities in its security products. The company says CVE-2026-93616 is a newly disclosed Security Management zero-day used in a handful of targeted attacks, while CVE-2026-85102 is now drawing a global wave of attempts against Spark firewall customers. Both carry a CVSS score of 9.8, and both have patches.
The timing is what turns this from a routine patch note into breaking incident-response work. Check Point had fixed CVE-2026-85102 on September 9, when it said there was no evidence of exploitation. Its September 22 update says attacks began on September 12. The management flaw was not publicly known until the company shipped its fix, but Check Point says it observed pinpointed attacks on July 23. Defenders are therefore patching after an exposure window, not before one.
Two flaws, two paths into trusted systems
CVE-2026-85102 sits in certificate validation during VPN negotiation. A remote attacker can present malicious certificate data and reach code execution without a valid account or user interaction. Check Point says the observed campaign used certificate subjects resembling generic VPN users and then looked for second-stage activity from suspicious Mobile Access sessions, including internal port and service scans. Those strings are leads, not a complete detection rule.
CVE-2026-93616 attacks a different layer. A path-traversal and file-upload bug in the management web service can let an unauthenticated attacker execute a script from an arbitrary path and load an arbitrary Java class. Check Point lists Security Management, Multi-Domain Security Management, Log Server, Multi-Domain Log Server and SmartEvent as affected. Its cloud-managed Smart-1 service and firewall appliances are not directly affected by this CVE.
That distinction does not make the management flaw harmless. A management server distributes policy and coordinates systems that operators trust to enforce the network boundary. Compromise there can undermine confidence in the configuration those gateways receive, even when the boxes forwarding traffic are not themselves vulnerable to CVE-2026-93616.
LivePatch is not the patch this time
The operational trap is explicit: Check Point says LivePatch Take 28/29 does not fix the management vulnerability, and no LivePatch will be available because of the nature of the correction. Administrators need the dedicated R82.20 security hotfix or the fixed Jumbo Hotfix release for their supported branch. As an interim measure, the company advises placing management servers behind a security gateway and limiting TCP port 19009 to trusted addresses.
Canada’s Cyber Centre confirms that CISA added both flaws to the Known Exploited Vulnerabilities catalog on September 22. SecurityWeek reports that U.S. federal civilian agencies received a three-day remediation window. That deadline applies to those agencies, but private operators should not mistake the absence of their own federal clock for extra safety.
Patching is necessary, not sufficient evidence that an installation was clean. Check Point has published indicators for suspicious long usernames, correlated core dumps and failed resource-file loads containing traversal paths. Operators should preserve relevant logs, apply the correct hotfix, run the vendor’s checks and escalate confirmed indicators through their incident-response process. The company has not publicly attributed either campaign, identified a motive or disclosed a complete victim count.
TINA’s view: assume exposure until the logs disagree
TINA’s view: affected Check Point environments should treat both vulnerabilities as possible compromise, with special attention to management servers that may appear protected by LivePatch. The strongest counterargument is that CVE-2026-93616 affected only a handful of known customers, management access should already be restricted, and Smart-1 Cloud received the fix. Those limits narrow exposure; they do not erase confirmed pre-disclosure exploitation.
This judgment would soften if Check Point established that the observed activity could not achieve code execution on supported builds, or if forensic review showed the July attacks were blocked attempts. It would harden with evidence of persistent access, policy manipulation, credential theft or broader scanning. The next signals to watch are a fuller victim count, independent technical confirmation of the exploit chain and any updated indicators. Until then, verify the exact hotfix rather than trusting the reassuring word "patched" in a nearby column.
