The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially listed two newly exposed vulnerabilities in Check Point products—both of which are being actively exploited in the wild. These security holes have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog as of September 22, 2026, with a remediation deadline of September 25 for organizations at risk. Affected systems include Security Gateway, Spark Firewall, Security Management Server, multiple-domain servers, Log Server, and SmartEvent. Failure to patch could expose companies to substantial breaches.
Vulnerability Details: RCE via VPN & Path Traversal in Management Tools
The first flaw, identified as CVE-2026-85102, is an improper certificate validation issue (CWE-295) found in Check Point’s Security Gateway and Spark Firewall when using Site-to-Site or Remote Access VPN. It allows unauthenticated remote attackers to potentially execute arbitrary code, without needing valid credentials. This directly threatens the integrity of gateway systems exposed to the internet where such VPNs are enabled.
The second, CVE-2026-93616, is a path traversal vulnerability impacting several Check Point management and logging platforms: Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Due to its CWE-22 classification, attackers could exploit this flaw to access and possibly upload or execute files in directories outside intended restrictions.
Risk Impact & Recommended Actions
Exploitation of either vulnerability could offer attackers a strong foothold inside affected environments. Unauthenticated code execution or script uploading could enable adversaries to steal credentials, manipulate security policies, execute malicious payloads, or discover lateral network paths. The advisory emphasizes that while no ransomware attacks have yet been publicly linked to either weakness, the threat level is considered high owing to the access granted to attackers.
CISA urges organizations to immediately identify any Check Point appliances and management servers that are reachable from the public internet. Administrators should apply available mitigations, follow the vendor’s guidance, and, if no mitigation is available, discontinue use of affected products until patches are released. Security teams should search logs, authentication records, VPN traffic, uploaded files, and signs of script execution before and after remediation to detect potential compromise.
These vulnerabilities underscore how critical it is for enterprises to monitor their peripheral exposure—especially of VPNs and management tools. Organizations relying on affected Check Point systems must act now or risk data theft, system manipulation, or deeper network compromise.
What this Means & What to Watch
This development highlights how even long-standing protection products like VPN gateways and log servers can harbor deeply dangerous flaws when critical validation or path constraints are misconfigured. The fact that attackers are already exploiting these vulnerabilities makes them urgent priorities for patching. Key indicators to watch for include unexpected script uploads on log or management servers, anomalies in VPN traffic, and policy changes without administrator approval. For tech leaders, this pushes the issue from theoretical security hygiene into emergency incident response protocols.
