Check Point Saw Attacks on Its Management Server in July. The Fix Shipped This Week

Check Point published a security advisory on September 22 covering two vulnerabilities, both rated CVSS 9.8, both now confirmed as attacked in the wild. One of them is in the Security Management Server — the box that holds the policy, the logs and the administrative keys to an organisation's entire firewall estate.

The more uncomfortable detail is in the timing. Check Point's advisory says of the management server flaw, CVE-2026-93616: "As of the advisory publications date, we observed a handful of pinpointed attacks on July 23, 2026." The fix is being distributed now. The advisory does not explain what happened in between.

What the two flaws are

CVE-2026-93616 is a pre-authentication path traversal in the Check Point management web service. Check Point describes the impact as arbitrary-path script execution and Java class loading — in plain terms, an attacker who can reach the management interface over the network can run code on it without credentials. BleepingComputer notes that CISA and the FBI have classed path traversal among the "unforgivable" defect classes since 2007, on the grounds that the industry has known how to eliminate it for two decades.

CVE-2026-85102 is a different problem in a different place: improper validation of certificate data during VPN negotiation on Security Gateway and Spark firewalls, again allowing unauthenticated remote code execution. That one was fixed on September 9. Check Point says a wave of exploitation attempts against Spark customers began worldwide on September 12 — three days later — with attackers using spoofed certificates and routing through VPN services and proxies to obscure their origin.

Check Point's instruction is the same for both: "Customers running affected versions should install the applicable fixes immediately."

Why the management server is the worse of the two

A gateway compromise is bad. A management server compromise is a different category of bad, and it is worth being precise about why.

The Security Management Server is not a device in the traffic path. It is the administrative control plane: it stores the rule base for every gateway it manages, pushes policy to them, holds administrator credentials and certificate authority material, and collects the logs that a defender would later use to reconstruct what happened. An attacker with code execution there does not need to break any individual firewall. They can change what the firewalls enforce, and they sit on top of the evidence trail.

That is also why the mitigation Check Point suggests — restricting access to the management interface by firewall rule and limiting trusted client addresses — is worth doing on its own merits, patch or no patch. A management plane exposed to the internet is a standing invitation, and this is the second consecutive year in which edge and management appliances from major security vendors have been the preferred entry point for well-resourced intruders.

The three-day number

The VPN flaw is the more familiar story, and in some ways the more instructive one. Check Point disclosed a fix on September 9. Arctic Wolf's write-up at the time recorded no known in-the-wild exploitation and no public proof-of-concept, while noting that the Dutch NCSC assessed that "exploitation attempts can be expected soon." The NCSC was right within seventy-two hours.

This is now the working assumption for any internet-facing security appliance: the publication of a fix is itself the starting gun, because a patch is a description of the defect written in a form attackers can read. Organisations that treat a critical appliance advisory as something to schedule into the next maintenance window are not operating on the same clock as the people attacking them.

What to do

Install the fixes for both CVEs. Restrict network access to the management interface to known administrator addresses. For the VPN flaw, Check Point asks customers to review logs for anomalous certificate-based Mobile Access logins and for second-stage activity from suspicious logged-in accounts. For the management server flaw, sk1000171 carries Check Point's mitigation guidance and indicators of compromise, and that hunt is the part not to skip — if attacks date to July, patching now closes the door but says nothing about who was already inside.

Sources: Check Point Security Advisory · BleepingComputer · The Hacker News · Arctic Wolf