Affected Systems

Check Point Security Gateway VPN product (all versions). Vulnerable versions: R81.10, R81.20, R82, R82.10. Also affects Spark firewalls. CVE-2026-85102 impacts VPN certificate-handling; CVE-2026-93616 (Management web service path traversal, exploited since July 23) also disclosed.

Exploitation Status

Active exploitation confirmed since September 12, 2026. Attackers using VPNs and proxies to obfuscate origin. CVE-2026-93616 exploited as zero-day since July 23, 2026. Added to CISA KEV catalog with federal remediation deadline of September 25, 2026.

Business Impact

Pre-authentication RCE allows full gateway compromise without credentials. Attackers can execute arbitrary code on Security Gateway appliances exposed to the internet. Organizations using Check Point VPN for remote access or site-to-site connectivity face immediate risk of perimeter breach. Exploitation attempts observed using specific certificate subjects (CN=vpn, CN=vpn-user, CN=vpnuser). No CVSS score published in advisory.

Urgency

🔴 Immediate

Recommended Actions

  • Install Check Point LivePatch Take 26 immediately on R81.20, R82, or R82.10 gateways, or deploy fixed Jumbo Hotfix: R81.20 Take 166+, R82 Take 126+, R82.10 Take 44+, or R81.10 Take 190+
  • Update Spark firewalls to R82.00.10 Build 2325 or R81.10.17 Build 4968 or later
  • Verify LivePatch activation by running 'cpinfo -y CPupdates' in expert mode on Security Gateway; customers with earlier offline LivePatch must install Take 26 for full coverage
  • If patching is not immediately feasible, disable VPN implied rules and create explicit rules restricting Site-to-Site VPN (UDP/500, UDP/4500) to known peer IPs; for Remote Access VPN, whitelist source client IP ranges and limit services to UDP/500, UDP/4500, TCP/443, TCP/80
  • Hunt for indicators of compromise: review VPN certificate logs for subjects CN=vpn, CN=vpn-user, CN=vpnuser (OU=users, O=global) and investigate connections from anonymization infrastructure (VPN/proxy IPs) starting September 12; consult Check Point support article for CVE-2026-93616 hunting guidance