Check Point CVE-2026-85102 and CVE-2026-93616: Dual Pre-Auth RCE, Patch by September 25

CVE-2026-85102 exploits the certificate validation code path inside the Check Point Security Gateway's IKE (Internet Key Exchange) implementation. When a Site-to-Site or Remote Access VPN is configured, the gateway must accept and validate incoming certificates during the VPN negotiation handshake. The flaw is an improper validation of certificate data: the gateway processes a specially crafted certificate from the connecting peer before completing any authentication check. Sending a malformed or oversized certificate structure causes memory corruption, leading to remote code execution on the gateway appliance. Because the exploit occurs during the pre-authentication phase of VPN negotiation, the attacker requires only network access to UDP/500 or UDP/4500 (IKE) on the affected gateway.

CVE-2026-93616 is a separate vulnerability on a different attack surface. The Check Point Security Management web service, which handles remote management operations, listens on TCP/19009. The service does not properly constrain which files and directories an incoming request can access. An unauthenticated attacker sends a crafted request containing directory traversal sequences (../), escaping the application's intended filesystem root. The file-upload component of the same web service allows attacker-controlled content to be written to the traversed path. A combined request traverses out of the web service root and writes a Java class file to an arbitrary location on the management server. The management server then loads that class, executing the attacker's code.

Both flaws are exploitable with no credentials, no session tokens, and no prior knowledge of the target environment beyond network access. For CVE-2026-85102, any network path to UDP/500 or UDP/4500 on the gateway is sufficient. For CVE-2026-93616, any network path to TCP/19009 on the management server is sufficient. Organizations that expose management servers to the internet without IP-based access controls are at immediate risk from CVE-2026-93616. Organizations with internet-facing VPN gateways are at immediate risk from CVE-2026-85102.

MITRE ATT&CK technique T1190 (Exploit Public-Facing Application) maps directly to both flaws. Post-exploitation activity from CVE-2026-85102 aligns with T1078 (Valid Accounts) as attackers observe credentials in transit, and T1021.001 (Remote Services) for subsequent lateral movement using harvested VPN credentials. CVE-2026-93616 post-exploitation maps to T1059 (Command and Script Interpreter) through the arbitrary Java class execution, and T1546 (Event Triggered Execution) if persistence is established through the management server's configuration.

CVE-2026-85102 affects Check Point Security Gateway and Spark Firewall across four major firmware branches: R81.10, R81.20, R82, and R82.10. Any organization running VPN (Site-to-Site or Remote Access) on these platforms is in scope. Smart-1 Cloud appliances are not affected by CVE-2026-85102 per Check Point's advisory.

CVE-2026-93616 has a broader management-plane impact. It affects Security Management Server, Multi-Domain Security Management Server (MDSM), Log Server, Multi-Domain Log Server, and SmartEvent. Smart-1 Cloud and Spark appliances are not affected by CVE-2026-93616. Any organization using on-premises Check Point management infrastructure where TCP/19009 is reachable from an untrusted network should treat this as an active compromise risk.

Check Point is deployed in large enterprise, government, financial services, and critical infrastructure environments as the primary security control for network segmentation and remote access. A compromised Security Gateway appliance gives an attacker direct visibility into all traffic flowing through it, including SSL-inspected sessions, VPN credentials, and internal routing tables. A compromised Management Server gives an attacker the ability to reprogram every gateway under its control simultaneously, disable logging, and create persistent access.

Organizations running legacy branches below R81.10 that lack an available hotfix must apply the mitigation guidance immediately: disable VPN implied rules and create explicit rules restricting Site-to-Site VPN traffic on UDP/500 and UDP/4500 to known peer IP addresses only. For CVE-2026-93616, restrict TCP/19009 access to trusted internal subnet ranges using firewall rules in front of the management server.

Check Point's threat intelligence team documented the exploitation campaign in detail. Starting September 12, 2026, a wave of exploitation attempts targeted Check Point Spark customers globally. The threat actors routed all attack traffic through anonymizing infrastructure, including commercial VPN services and open proxies, to obscure source IP addresses. This technique is consistent with threat actors who have specific organizational targets and want to slow attribution.

The post-exploitation behavior observed after successful CVE-2026-85102 exploitation follows a structured reconnaissance and lateral movement pattern. Defenders have reported anomalous certificate-based Mobile Access logins as the first sign of compromise, followed immediately by second-stage internal port and service scanning from the Mobile Access session. This sequence suggests the attacker gains initial RCE on the gateway, establishes a Mobile Access session using credentials extracted from the gateway's memory, then uses that authenticated session to scan internal network segments.

For CVE-2026-93616, Check Point flagged targeted attacks as early as July 23, 2026. The management server exploitation pattern differs from the gateway attack. Attackers specifically sought management server exposure on TCP/19009, suggesting pre-knowledge of Check Point management infrastructure topology. The targeted nature of early CVE-2026-93616 exploitation contrasts with the broader automated campaign seen against CVE-2026-85102 after September 12.

The full chain represents a two-stage attack against the Check Point security stack: the gateway flaw provides initial perimeter access, and the management server flaw provides control over the organization's entire firewall infrastructure. CISA's forensic triage requirement in the KEV entry reflects this severity: organizations with evidence of compromise should treat all gateway-managed policies and management-stored credentials as potentially exfiltrated.

Check Point's support article sk1000171 contains the authoritative IOC list for both CVEs. The indicators below represent the publicly documented behavioral patterns and filesystem artifacts associated with active exploitation. Hunt these in your Check Point gateway logs, management server access logs, and network flow data before applying patches.

Connections to TCP/19009 from external or unexpected source IPs are the primary network indicator for CVE-2026-93616. The management web service should only receive connections from trusted administrator workstations and management subnets. Any connection from an internet-routable IP to TCP/19009 should be treated as a compromise indicator. For CVE-2026-85102, review VPN negotiation logs for certificate subjects matching the IOC list in sk1000171 and for anomalous certificate-based Mobile Access authentication events followed by internal scanning activity.

Two detection rules cover the primary exploitation paths: path traversal targeting the management web service (CVE-2026-93616) and anomalous VPN certificate authentication patterns (CVE-2026-85102). Both carry experimental status; validate log source availability in your environment before enabling automatic blocking.

Check Point has released hotfixes covering both CVEs across all affected branches. Apply the specific build for your firmware version immediately. Do not wait for the next scheduled maintenance window given the CISA September 25 deadline and confirmed active exploitation.

Check Point Security Gateway is not a passive monitoring tool. It is the trust enforcement point for every inbound and outbound connection in the network. An attacker with code execution on the gateway appliance occupies the most privileged position in the network from a traffic visibility perspective. Every SSL-inspected session exposes its plaintext content to the attacker. Every VPN tunnel reveals the credentials of connecting users. Every firewall rule can be read, modified, or disabled.

The combination of CVE-2026-85102 and CVE-2026-93616 makes this threat qualitatively different from a single CVE on a single product. Gateway RCE gives the attacker data-plane control. Management server RCE gives the attacker policy-plane control. Together, they represent total compromise of the security architecture built around Check Point infrastructure.

The same attack pattern has played out before. In 2024, CVE-2024-24919, an information disclosure flaw in Check Point Security Gateway, was mass-exploited to read VPN credentials, giving attackers authenticated access to corporate networks without triggering RCE detections. These two 2026 CVEs are more severe: they require no authentication at all, and they reach both the perimeter gateway and the management plane simultaneously.

Organizations should treat any Check Point Security Gateway running VPN and any Check Point Management Server with external TCP/19009 exposure as potentially compromised if patches have not been applied by September 12. Review Citrix NetScaler CVE-2026-19490 and Fortinet FortiGate CVE-2025-25249 for parallel examples of perimeter appliance exploitation resulting in full network lateral movement.