Check Point Zero-Days Put Patching on a Clock

Check Point zero-days is the focus of a newly disclosed security response dated 2026-09-22. This report separates what is verified from what buyers and operators still need to test.

Check Point zero-days change the incident timeline

Check Point says attackers are exploiting two pre-authentication vulnerabilities in products that sit at the edge of enterprise networks. CVE-2026-85102 affects VPN certificate handling in Security Gateway and Spark Firewall deployments and can lead to remote code execution without credentials. CVE-2026-93616 affects the management web service and can allow an attacker to execute a script from an arbitrary path and load a Java class. The company published its active-exploitation advisory on 22 September 2026. BleepingComputer, SecurityWeek, the Canadian Centre for Cyber Security and the Netherlands NCSC separately reported or confirmed the changed risk state.

One patched flaw became a live threat

CVE-2026-85102 had fixes available from 9 September, when Check Point said it had no evidence of exploitation. The vendor now says it observed a wave of attempts against Spark customers beginning on 12 September, including traffic from anonymisation infrastructure and crafted certificate subjects. This sequence matters operationally. A team that scheduled the earlier patch as ordinary maintenance must now treat every still-unpatched exposed system as a possible incident. Applying the fix closes the vulnerability, but it cannot show whether the device was already reached before the update.

The management flaw creates a deeper trust problem

CVE-2026-93616 is a separate pre-authentication path-traversal vulnerability in Security Management components. Check Point says it observed a handful of targeted attacks on 23 July, before the public fix. Because management servers control policy and can hold sensitive configuration, compromise may affect more than one appliance. Defenders should not infer that a small number of observed attacks means low consequence. Limited visibility, selective targeting and privileged placement can make a narrow campaign materially dangerous.

Why perimeter appliances demand two workstreams

Everyone else is reporting critical CVEs; we are explaining why patching and compromise assessment must run together. Internet-facing VPN and management devices are authentication and policy boundaries. If an attacker gains execution there, later activity may originate from an address or user that internal systems normally trust. The first workstream is exposure reduction: install the vendor hotfix, verify the exact build and restrict management access. The second is investigation: preserve logs, compare activity with vendor indicators and search for accounts, scans, scripts or connections that appeared before remediation.

The CVE-2026-85102 hunt

Check Point recommends reviewing logs for anomalous certificate-based Mobile Access logins and warns defenders not to search only for the certificate subjects already disclosed. Known examples include subjects resembling vpn, vpn-user and vpnuser, but the list is not exhaustive. Teams should correlate unusual logins with source infrastructure, new internal scans, configuration changes and second-stage connections. A certificate string is a lead, not proof by itself. Conversely, absence of the published strings does not establish that the gateway was untouched.

The CVE-2026-93616 hunt

For the management vulnerability, the investigation should centre on the management web service, unexpected script paths, Java class loading, new files and unexplained process or network activity. Administrators should use Check Point’s product-specific advisory and support guidance for exact versions, hotfix takes and validation commands. Generic advice can miss deployment details, especially in multi-domain environments or appliances with long upgrade histories. If logs are incomplete, teams should record that uncertainty rather than convert it into a clean bill of health.

Prioritisation should follow exposure and privilege

The fastest triage order is internet-exposed affected systems, management servers, devices without the relevant hotfix and environments where remote-access services are enabled. Asset inventories should include centrally and locally managed Spark devices, Security Gateways and management components, not just the flagship firewall cluster. Owners should document the version, exposure, patch state, last verified backup and logging destination for each asset. This creates an auditable response list and prevents a smaller branch appliance from falling outside the main change window.

Patching must be verified, not assumed

A change ticket marked complete is not evidence that every node is protected. Teams should check the vendor’s exact build or take, confirm services restarted as expected and make sure high-availability peers did not remain on an old image. They should also test remote access and policy management after remediation so operational pressure does not trigger an unsafe rollback. Where immediate patching is impossible, the vendor’s supported mitigation and access restrictions should be applied, with an owner and near-term deadline for the full fix.

Do not overstate attribution or victim counts

The accessible sources establish exploitation, affected components and vendor-observed timing. They do not publicly establish a single threat actor, a complete victim list or the total number of compromised devices. This package therefore avoids naming an attacker or estimating impact. Security reporting is most useful when it distinguishes observed attempts, confirmed compromise and technical possibility. Organisations should make disclosure decisions from their own evidence and applicable obligations, not from an assumed global campaign profile.

What leaders should ask for now

Security leaders should request a signed inventory of affected assets, patch validation evidence, the earliest available logs, the hunting queries used and a list of gaps. They should ask whether management access is segmented, whether configuration backups are trustworthy and whether identity systems show suspicious activity after the first observed exploitation dates. They should also define the threshold for isolating or rebuilding an appliance. A dashboard that reports only patch percentage hides the central question: did an attacker act before the patch landed?

The bottom line

The quotable answer: Check Point zero-days CVE-2026-85102 and CVE-2026-93616 are actively exploited pre-authentication flaws at the network perimeter, so organisations need both verified hotfix deployment and a retrospective compromise hunt. CVE-2026-85102 moved from patched vulnerability to observed attacks, while CVE-2026-93616 was used in targeted activity before public remediation. The defensible response is to reduce exposure, preserve evidence and treat missing telemetry as uncertainty.

Facts table

Vendor advisory	22 September 2026
CVE-2026-85102	Pre-auth VPN certificate handling RCE; CVSS 9.8
CVE-2026-93616	Pre-auth management path traversal and code execution
Observed activity	Spark attempts from 12 September; targeted management attacks observed 23 July
Required response	Patch, validate build, hunt logs and second-stage activity

FAQs

What are the Check Point zero-days?

CVE-2026-85102 is a pre-authentication VPN certificate-handling RCE, while CVE-2026-93616 is a pre-authentication management web-service path traversal that can enable code execution.

Are the vulnerabilities actively exploited?

Yes. Check Point and multiple independent authorities report observed exploitation, including attempts against Spark customers and targeted management-server activity.

Is patching enough?

No. Patching prevents future exploitation of the fixed flaw, but organisations should also review logs and hunt for activity that may have occurred before remediation.

Which systems should be prioritised?

Prioritise internet-facing affected gateways, Spark firewalls and management servers, especially systems without the exact vendor hotfix and deployments with remote access enabled.

Related Lapaas Voice coverage

• F5 BIG-IP Zero-Day Demands Forensic Triage
• Microsoft Defender ISOC Unifies Agentic Security
• Tera Context Engine Adds Governed AI Layer