CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Check Point Security Management Server

product · product:check-point-security-management-server

Coverage
5
first 2026-07-23 → last 2026-10-20
Latest activity
2026-10-04
Check Point patches a management-server zero-day it says has already been used in a handful of pinpointed…
Peak priority
critical
2 critical · 3 high
Targets
public-sector
sectors: public-sector, energy, finance · regions: europe, switzerland
Sources cited
24
12 hosts

Action items (14)

Do-now tasks recorded on the entries about Check Point Security Management Server, newest first. Check the date before acting on an older one.

  • Immediate action: Check Point confirms this pre-authentication path-traversal flaw was exploited as a zero-day against a handful of customers, with attacks observed on 2026-07-23. Apply the R82.20 Security Hotfix or the appropriate Jumbo Hotfix Accumulator (R82.20 Take 10+, R82.10 Take 45+, R82 Take 127+, R81.20 Take 170+, R81.10 Take 192+) immediately; the September LivePatch does not cover this issue. Until patched, restrict TCP/19009 on every affected server to trusted administrative IP ranges via Trusted Clients / implied rules, and check the file-integrity paths in the 2026-10-04 update below alongside Check Point's revised log indicators.
    2026-09-23CVE-2026-93616
  • Apply the R82.20 Security Hotfix or the appropriate Jumbo Hotfix Accumulator to every Check Point Security Management / Multi-Domain Security Management / Log / Multi-Domain Log / SmartEvent server now; no LivePatch exists for this issue.
    2026-09-23CVE-2026-93616
  • Until patched, restrict TCP/19009 to trusted administrative IP ranges via Trusted Clients / implied rules on every affected server.
    2026-09-23CVE-2026-93616
  • On every affected server that was reachable on TCP/19009 while unpatched, check /etc/cron.d, authorized_keys, the startup paths and anything new under $FWDIR/conf/SMC_Files for unexpected changes, alongside Check Point's revised log indicators in sk1000171.
    2026-09-23CVE-2026-93616
  • Immediate action: Check Point confirms active exploitation of CVE-2026-85102 against Spark Firewall customers globally since 2026-09-12, three days after the fix shipped, via certificate-based Mobile Access logins from anonymization infrastructure (VPN services and proxies). Any Spark Firewall, Security Gateway or Security Management Server not yet on LivePatch Take 24 / the appropriate Jumbo Hotfix Accumulator is exposed now, a management server even where VPN is not configured. Review Mobile Access logs for anomalous certificate-based logins and any follow-on internal port/service scanning from suspicious Mobile Access sessions, regardless of whether the device has already been patched.
    2026-09-10CVE-2026-85103 +1
9 older action items
  • Apply LivePatch Take 24 or the appropriate Jumbo Hotfix Accumulator to every Check Point Security Gateway, Security Management Server and Spark Firewall now, including management servers with no VPN configured, which Check Point states are vulnerable regardless of configuration; if the offline LivePatch package was used on R82.10 JHF Take 24 or lower / R82 JHF Take 107 or lower / R81.20 JHF Take 146 or lower, also install the hardened Take 26; the locally managed Spark Firewall has no workaround short of patching.
    2026-09-10CVE-2026-85103 +1
  • Review Mobile Access logs for anomalous certificate-based logins and any follow-on internal port/service scanning from suspicious Mobile Access sessions on every Spark Firewall, whether or not it has already been patched.
    2026-09-10CVE-2026-85103 +1
  • Apply the CVE-2026-91843 fix to every Check Point Security Management, Multi-Domain Security Management, Log Server and Multi-Domain Log Server now, preferably as a Jumbo Hotfix take that also fixes the exploited CVE-2026-93616 (R82.10 Take 45, R82 Take 127, R81.20 Take 170, R81.10 Take 192), otherwise as the LivePatch (confirm cplp list in Expert mode shows it armed), and verify no Trusted Client/GUI access to the login interface reaches it from outside the management network.
    2026-09-18CVE-2026-91843
  • Apply Jumbo Hotfix Accumulator Take 161 (R81.20), Take 122 (R82) or Take 40 (R82.10) to every Security Management and Multi-Domain Management Server, and for any R80.x / R81 / R81.10 server (where no fix exists) restrict the management interface to the administrative network now, because that is the only control available.
    2026-08-05CVE-2026-18574
  • Set Trusted Clients on every management server to explicit hosts and subnets and remove any 'Any' definition, which Check Point names as the configuration that increases exposure to this flaw.
    2026-08-05CVE-2026-18574
  • Restrict SmartConsole 'Trusted Clients' (the GUI-client IP allow-list) on every internet-reachable Check Point Security Management and Multi-Domain Management server to known administrator IPs now (the network-layer restriction neutralises the token bypass independent of patch state) and apply the 2026-07-22 Jumbo Hotfix.
    2026-07-23CVE-2026-16232 +2
  • On any Management Server that was internet-exposed without a Trusted-Clients restriction, review SmartConsole authentication logs for logins authenticated via application token from outside the admin IP range and audit the security-policy and object change history for unexpected administrative changes.
    2026-07-23CVE-2026-16232 +2
  • If you deferred the Check Point Jumbo Hotfix (R82.10 Take 36+ / R82 Take 118+ / R81.20 Take 158+) because CVE-2026-16232 was mitigated by network restrictions, apply it now, the same bundle closes an unauthenticated command-execution flaw (CVE-2026-62144) on the identical management surface.
    2026-07-23CVE-2026-16232 +2
  • Check the Trusted Clients configuration on every Check Point Security Management and Multi-Domain Management server: Rapid7 found the GUI-client-unrestricted setting that makes this exploitable is the default, so restricting SmartConsole access to known administrative addresses removes the reachability the exploit depends on even where patching lags.
    2026-07-23CVE-2026-16232 +2

Defender insights

What each entry about Check Point Security Management Server tells a defender to do, newest first.

2026-09-23CRITICALexploitedCheck Point patches a management-server zero-day it says has already been used in a handful of pinpointed attacks

Triage

2026-09-10CRITICALexploitedTwo pre-auth code-execution flaws sit in the certificate-processing step every VPN negotiation runs before a user ever authenticates

2026-09-18HIGHA stack overflow in Check Point's unauthenticated management login reaches root. Patch or restrict management access now

Triage · detection

2026-08-05HIGHA fourth Check Point management-plane CVE in two weeks, and every end-of-support train is unfixed

Triage

2026-07-23HIGHexploitedCheck Point patches an actively-exploited SmartConsole authentication bypass granting full management-server admin

Latest update · triage

Story timeline

  1. 2026-09-23CVE-2026-93616, Check Point Security Management: pre-authentication path traversal to arbitrary script execution, exploited as a zero-day, with attacks observed on 2026-07-23 (CVSS 9.8)
    trending-vulnerabilitiesCheck Point patches a management-server zero-day it says has already been used in a handful of pinpointed attacks
  2. 2026-09-18CVE-2026-91843, Check Point Security Management / Multi-Domain Security Management / Log Server: unauthenticated stack overflow in the login process reaches root RCE (CVSS 9.8)
    trending-vulnerabilitiesA stack overflow in Check Point's unauthenticated management login reaches root. Patch or restrict management access now
  3. 2026-09-10Check Point Quantum Security Gateway / Management Server / Spark Firewall: two unauthenticated CVSS 9.8 pre-auth RCE flaws in VPN certificate processing (CVE-2026-85103 heap overflow, CVE-2026-85102 improper cert validation)
    trending-vulnerabilitiesTwo pre-auth code-execution flaws sit in the certificate-processing step every VPN negotiation runs before a user ever authenticates
  4. 2026-08-05CVE-2026-18574, Check Point Security Management: unauthenticated bypass of management authentication to arbitrary command execution, with no fix for seven end-of-support trains
    trending-vulnerabilitiesA fourth Check Point management-plane CVE in two weeks, and every end-of-support train is unfixed
  5. 2026-07-23CVE-2026-16232, Check Point SmartConsole: authentication bypass to full admin, exploited in the wild (CVSS 9.1)
    trending-vulnerabilitiesCheck Point patches an actively-exploited SmartConsole authentication bypass granting full management-server admin

Hunting pivots

CVEs (exploited first)
CVE-2026-16232CVE-2026-85102CVE-2026-93616CVE-2026-18574CVE-2026-62144CVE-2026-62145CVE-2026-85103CVE-2026-91843
Releases covered
Check Point Security Management Server ×4Check Point Security Management ×2
Tags
pre-auth ×5rce ×5vulnerabilities ×5patch-available ×4actively-exploited ×3cisa-kev ×3auth-bypass ×2default-configidentityno-patchpoc-publicpriv-esczero-day
ATT&CK techniques (5 across 5 tactics)

5 techniques observed across 5 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionScheduled Task/Job: Cron · Command and Scripting Interpreter
  • PersistenceScheduled Task/Job: Cron
  • Privilege EscalationScheduled Task/Job: Cron · Exploitation for Privilege Escalation
  • Credential AccessForge Web Credentials

Initial Access TA0001

T1190Exploit Public-Facing Application×5

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-23/cve-2026-93616-check-point-security-mgmt-path-traversal · 2026-09-18/cve-2026-91843-check-point-security-mgmt-stack-overflow · 2026-09-10/checkpoint-quantum-vpn-cert-preauth-rce-cvss98 · 2026-08-05/check-point-cve-2026-18574-management-auth-bypass · 2026-07-23/check-point-smartconsole-auth-bypass-cve-2026-16232 · ATT&CK page ↗

Execution TA0002

T1053.003Scheduled Task/Job: Cron×1

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

Evidence: 2026-09-23/cve-2026-93616-check-point-security-mgmt-path-traversal · ATT&CK page ↗

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-08-05/check-point-cve-2026-18574-management-auth-bypass · ATT&CK page ↗

Persistence TA0003

T1053.003Scheduled Task/Job: Cron×1

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

Evidence: 2026-09-23/cve-2026-93616-check-point-security-mgmt-path-traversal · ATT&CK page ↗

Privilege Escalation TA0004

T1053.003Scheduled Task/Job: Cron×1

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

Evidence: 2026-09-23/cve-2026-93616-check-point-security-mgmt-path-traversal · ATT&CK page ↗

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-07-23/check-point-smartconsole-auth-bypass-cve-2026-16232 · ATT&CK page ↗

Credential Access TA0006

T1606Forge Web Credentials×1

Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.

Evidence: 2026-07-23/check-point-smartconsole-auth-bypass-cve-2026-16232 · ATT&CK page ↗

Entries about Check Point Security Management Server (5)

2026-09-23 · view entry permalink →

CRITICALCVE-2026-93616exploitedupdatedNATOA1

CVE-2026-93616, Check Point Security Management: pre-authentication path traversal to arbitrary script execution, exploited as a zero-day, with attacks observed on 2026-07-23 (CVSS 9.8)

Check Point discloses a pre-authentication directory-traversal and file-upload vulnerability that lets an unauthenticated attacker upload and execute arbitrary scripts on the Check Point Management Server (Check Point Support, sk1000171, 2026-09-22), which in Check Point Research's words "allows an attacker to execute a script from an arbitrary path and load an arbitrary Java class" (Check Point Research, 2026-09-22). It affects Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent; Smart-1 Cloud already carries the fix, and Security Gateway appliances and Spark Firewall are not affected (Check Point Support, sk1000171, 2026-09-22). Check Point states it identified "a handful of pinpointed attacks" exploiting this as a zero-day on 2026-07-23 (Check Point Research, 2026-09-22), roughly two months before the 2026-09-22 disclosure and fix. Affected versions: R82.20 without the Security Hotfix or Jumbo Hotfix Take 10, R82.10 Jumbo Hotfix Take 44 or lower, R82 Take 126 or lower, R81.20 Take 166 or lower, R81.10 Take 190 or lower (end-of-support), and the end-of-support R80/R80.10–R80.40/R81 lines (Check Point Support, sk1000171, 2026-09-22). Fixed in the R82.20 Security Hotfix or Jumbo Hotfix Accumulator R82.20 Take 10+, R82.10 Take 45+ / R82 Take 127+ / R81.20 Take 170+ / R81.10 Take 192+; sk1000171 lists no fix for the end-of-support R80 through R81 lines (Check Point Support, sk1000171, 2026-09-22). Check Point states plainly "because of the nature of the fix, a LivePatch is not be available for this issue" (Check Point Support, sk1000171, 2026-09-22); the September LivePatch (Take 28/29) that addressed the unrelated CVE-2026-91843 flaw does not cover this vulnerability (The Hacker News, 2026-09-22). CISA added it to KEV the same day (CISA KEV, catalogue version 2026.09.22). This is a distinct, unrelated flaw from CVE-2026-85102 (a separate Check Point Security Gateway/Spark VPN certificate-validation RCE, disclosed 2026-09-09, with exploitation attempts reported from 2026-09-12 (Check Point Research, 2026-09-22)), with different components and no CVE overlap.

Detection concept: Check Point's sk1000171, revised on 2026-10-13, lists four indicators in the management-process log (cpm.elg): one for the authentication bypass, a login whose username field exceeds 1,000 characters with a management-process core dump written at the same moment, and three for an attacker already past authentication: a suspicious version path in an Invoking method ... in version: log line, which Check Point's search matches on dots, slashes, backslashes and their URL-encoded forms, an upload path carrying directory traversal toward the upgrade-tools files, and a JAR path that breaks out of the expected upgrade-tools directory (Check Point Support, sk1000171, 2026-09-22). Bishop Fox said on 2026-10-01 that its route to root never trips the upgrade-tools load-error indicator Check Point then listed, since that route writes a scheduled-task file and never calls the upgrade service (Bishop Fox, 2026-10-01); the revised sk1000171 no longer lists that indicator (Check Point Support, sk1000171, 2026-09-22); neither Check Point nor Bishop Fox states whether the three new indicators catch that route, so file-integrity checks remain the test that does not depend on them. Triage: Check Point treats the over-long username paired with a simultaneous core dump as a possible attempt on this flaw's authentication bypass (Check Point Support, sk1000171, 2026-09-22), while Bishop Fox calls the same pairing the crash signature of the separate CVE-2026-91843, which the same hotfix fixes, and not evidence of this traversal (Bishop Fox, 2026-10-01); an over-long username without a matching core dump does not meet Check Point's indicator. Hardening: because no LivePatch exists, restrict network reachability to the management web service (Check Point names TCP/19009 specifically) to trusted administrative IP ranges via the platform's Trusted Clients or implied-rule mechanism, which Bishop Fox calls Check Point's primary mitigation (Bishop Fox, 2026-10-01).

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on the Check Point Management Server. This vulnerability is exploited in the Wild. Check Point is aware of a handful of customers who have been attacked.

Check Point Support (sk1000171) 2026-09-22

As of the advisory publications date, we observed a handful of pinpointed attacks on July 23, 2026.

Check Point Research (blog) 2026-09-22

Because of the nature of the fix, a LivePatch is not be available for this issue.

Check Point Support (sk1000171) 2026-09-22

One exploit ran end to end against both unpatched hosts, confirming root on each, self-contained over the exposed port.

It fires only when an upgrade-tools load fails, which makes it a weak net both ways.

The primitive underneath is an arbitrary root write, so what catches this is file-integrity monitoring rather than a log grep.

Check Point remediated more than it described.

Bishop Fox 2026-10-01

If a core dump file was generated at the same time as the login attempt returned by the first command, there has been a potential attempt to exploit this vulnerability

Check Point Support (sk1000171) 2026-09-22
Updaterun 2026-10-04T0405Z-inteltitlesummaryimmediate_actiontagstechniquescvessourcesevidencesourcing_noteactionsbody

Bishop Fox published on 2026-10-01 a lab reproduction of an unauthenticated root code-execution chain on unpatched R81.10 and R82.10 management servers, run end to end over TCP 19009 (Bishop Fox, 2026-10-01). The chain mints a session by presenting the server's own internal certificate name, which the server accepts from a caller-supplied string without checking that a certificate was presented, then uses the file service to write a file anywhere as root; overwriting a stock scheduled-task file makes the system's cron daemon run the attacker's command as root with no further request, and the output is read back over the same session (Bishop Fox, 2026-10-01). Bishop Fox confirmed two further routes from the same write to code execution and says closing any one leaves the others standing (Bishop Fox, 2026-10-01). The post describes the chain but links only a patch-state scanner, not the exploit script.

Bishop Fox reads the hotfix as closing three defects while the advisory names two: the forged login, the unbounded file write and the upgrade-service parameter validation, with either of the first two alone breaking the chain; this is its comparison of the shipped code, not a Check Point statement (Bishop Fox, 2026-10-01). Its scanner reads patch state from outside with one benign request to the management port and, per its README, does not detect prior compromise (Bishop Fox, 2026-10-01).

Bishop Fox says Check Point's second indicator at the time (an upgrade-tools load-error grep, as sk1000171 then listed it) fires only when an upgrade-tools load fails and is never reached by this route, so it leaves neither the error line nor the parent-directory sequence, and that a genuine upgrade can trip it; it calls the first indicator, an over-long username next to a core dump, the crash signature of the separate CVE-2026-91843 and not evidence of this traversal (Bishop Fox, 2026-10-01). An exposed, unpatched server with neither log sign is therefore not shown to be clean. Its hunting advice is file-integrity monitoring of scheduled-task directories, startup and SSH key paths, the normally empty upgrade-tools directory, the CPM configuration files and anything new in the output-staging directory, paired with execution telemetry, cron reload events and an alert on the management Java process spawning a shell, because a scheduled hash check can miss stock files restored byte for byte (Bishop Fox, 2026-10-01). It also notes that the Trusted Clients restriction is a permissions setting that emits an implied rule, so a rule-base audit alone can miss it (Bishop Fox, 2026-10-01).

Correctionrun 2026-10-11T1307Z-auditcvesbodyimmediate_actionactions

Check Point's sk1000171 lists R82.20 as affected without an all-takes scope, and the fix is also included in the Jumbo Hotfix Accumulator for R82.20 from Take 10; it lists no fix for the end-of-support R80 through R81 lines (Check Point Support, sk1000171, 2026-09-22). Check Point revised sk1000171 on 2026-10-13: it now lists an authentication-bypass indicator and three indicators for an attacker past authentication, a suspicious version path invocation, an upload path with directory traversal and a JAR path breaking out of the upgrade-tools directory (Check Point Support, sk1000171, 2026-09-22).

Correctionrun 2026-10-20T0835Z-auditbodyevidenceimmediate_actionsummary

The urgent patch instruction omitted the Jumbo Hotfix Accumulator for R82.20 from Take 10, which Check Point lists as carrying the fix alongside the R82.20 Security Hotfix (Check Point Support, sk1000171, 2026-09-22).

Bishop Fox's statement that Check Point's indicators miss its route dates from its 2026-10-01 post and concerned the upgrade-tools load-error indicator, which its scheduled-task-file route never trips (Bishop Fox, 2026-10-01); sk1000171 as revised on 2026-10-13 no longer lists that indicator and gives three post-authentication checks instead (Check Point Support, sk1000171, 2026-09-22), and neither party states whether they catch the route. The revised first indicator is not only an over-long username: Check Point pairs it with a management-process core dump written at the same moment, "If a core dump file was generated at the same time as the login attempt returned by the first command, there has been a potential attempt to exploit this vulnerability" (Check Point Support, sk1000171, 2026-09-22), and that pairing is the one Bishop Fox calls the crash signature of CVE-2026-91843 rather than evidence of this traversal (Bishop Fox, 2026-10-01).

Builds on: Two pre-auth code-execution flaws sit in the certificate-processing step every VPN negotiation… · A stack overflow in Check Point's unauthenticated management login reaches root. Patch or…

vulnerability23 Sep 04:40Zmulti-sourceOpen finding →
Sources: Check Point Support (sk1000171) · Check Point Research (blog) · The Hacker News · CISA KEV · Bishop Fox · Bishop Fox (detection tool README)

2026-09-10 · view entry permalink →

CRITICALCVE-2026-85103 +1exploitedupdatedNATOA2

Check Point Quantum Security Gateway / Management Server / Spark Firewall: two unauthenticated CVSS 9.8 pre-auth RCE flaws in VPN certificate processing (CVE-2026-85103 heap overflow, CVE-2026-85102 improper cert validation)

Check Point created two Critical-severity advisories on 2026-09-07, disclosed them with the fixes on 2026-09-09 and revised them on 2026-09-18 (sk1000118) and 2026-09-24 (sk1000117), for its VPN certificate-handling code, both triggered during certificate processing before authentication completes and both discovered internally with no external researcher credited (Check Point, advisory sk1000118, 2026-09-07; sk1000117, 2026-09-07). CVE-2026-85103 (CVSS 9.8) is "a heap overflow in the VPN certificate ASN.1 decoding flow" that "may allow an attacker to remotely execute arbitrary code on the Security Management Server and Security Gateway", and Check Point now adds that every Security Management Server deployment is vulnerable regardless of configuration, including one where VPN is not in use (Check Point, sk1000118). CVE-2026-85102 (CVSS 9.8, CWE-295 improper certificate validation) is an authentication-bypass-to-RCE in Remote Access and Site-to-Site VPN negotiation: "improper validation of certificate data during VPN negotiation may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway" (Check Point, sk1000117), reachable against the Security Gateway and Spark Firewall. Affected: R81.20, R82, R82.10, and the end-of-support R80/R80.10/R80.20/R80.30/R80.40/R81/R81.10 lines and their .x builds; R82.20 is confirmed not affected. Both vulnerabilities were discovered internally by Check Point; there were no reports of active exploitation as of the 2026-09-09 disclosure (Forkast News, 2026-09-09), but CVE-2026-85102 is now under confirmed active exploitation (see the Update below); this is a distinct certificate-processing defect from the June 2026 IKEv1 key-exchange flaw (CVE-2026-50751) already on CISA KEV. Fix is delivered via Check Point LivePatch Take 24 (automatic if enabled) or Jumbo Hotfix Accumulator (R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+, R81.10 Take 190+), plus dedicated Spark Firewall builds (R82.00.10 Build 2325+, R81.10.17 Build 4968+). No workaround exists for the locally-managed Spark Firewall. For a system that cannot take the fix, Check Point's interim mitigation replaces the VPN implied rules with explicit ones: for Site-to-Site VPN, UDP/500 and UDP/4500 allowed only from the specific peer addresses, and for Remote Access VPN, explicit rules for the required services restricted to the client address ranges where that is possible (Check Point, sk1000117).

A heap overflow in the VPN certificate ASN.1 decoding flow may allow an attacker to remotely execute arbitrary code on the Security Management Server and Security Gateway.

All Security Management Server deployments are vulnerable, regardless of configuration, and require the fix described below.

Check Point (vendor advisory sk1000118) 2026-09-07

Gateways that participate only in encryption communities where authentication is based on a Pre-Shared Key are not vulnerable.

Improper validation of certificate data during VPN negotiation may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway.

Check Point (vendor advisory sk1000117) 2026-09-07

Both vulnerabilities were discovered internally by Check Point, and there are no reports of active exploitation as of September 9, 2026.

Forkast News 2026-09-09

Check Point disclosed the vulnerability and released fixes on September 9, 2026. At the time, we had no evidence of exploitation. We are now observing exploitation attempts against Check Point Spark customers globally.

Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers. The attempts originated from anonymization infrastructure, including VPN services and proxies

Check Point Research (blog) 2026-09-22

Following additional research, we identified a rare scenario in which customers must install Check Point Live Patch Take 26, which provides enhanced coverage for this CVE.

Check Point (vendor advisory sk1000117) 2026-09-07
Updaterun 2026-09-23T0405Z-intelsummarypriorityimmediate_actioncvestagssourcesevidenceactionssourcing_noteentitiesbody

CISA added CVE-2026-85102 to its Known Exploited Vulnerabilities catalog on 2026-09-22 (CISA KEV, catalogue version 2026.09.22), and Check Point's own advisory confirms the reason: "Check Point disclosed the vulnerability and released fixes on September 9, 2026. At the time, we had no evidence of exploitation. We are now observing exploitation attempts against Check Point Spark customers globally" (Check Point Research, 2026-09-22). "Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers. The attempts originated from anonymization infrastructure, including VPN services and proxies" (Check Point Research, 2026-09-22), three days after the 2026-09-09 fix shipped. Check Point's own advisory sk1000117 carries a September 14 update explaining why some already-patched customers remained exposed during that wave: for customers who installed the Offline LivePatch Package while running R82.10 Jumbo Hotfix Take 24 or lower, R82 Jumbo Hotfix Take 107 or lower, or R81.20 Jumbo Hotfix Take 146 or lower, "following additional research, we identified a rare scenario in which customers must install Check Point Live Patch Take 26, which provides enhanced coverage for this CVE" (Check Point Support, sk1000117, updated 2026-09-14), a coverage gap in the original fix, closed by a second, hardened LivePatch issued five days after the initial patch and two days after exploitation attempts began. CVE-2026-85103, the companion heap-overflow certificate-decoding flaw, is unaffected by this gap and remains not confirmed exploited. Check Point's own hunting guidance: review logs for anomalous certificate-based Mobile Access logins without limiting the search to the observed certificate subjects, and treat follow-on internal port or service scanning from a logged-in Mobile Access session as second-stage activity warranting investigation.

Updaterun 2026-09-29T2134Z-auditsummaryimmediate_actioncvesevidenceactionsreferencesbody

Check Point's revision of sk1000118 on 2026-09-18 widens the population that needs CVE-2026-85103's fix. Its clarification reads: "All Security Management Server deployments are vulnerable, regardless of configuration, and require the fix described below". The flaw does not depend on any management configuration, and a management server is vulnerable even when VPN is neither used nor configured. The advisory now also lists the Spark Firewall among the affected products, and the R81.10 Jumbo Hotfix Accumulator from Take 190 carries the fix (Check Point, sk1000118, updated 2026-09-18). A Management Server that was left out of the patch round because it terminates no VPN is therefore in scope.

Both advisories now also give an interim mitigation for Remote Access VPN, which this entry had said did not exist: disable the Remote Access VPN implied rules and create explicit access rules for the services the clients need (UDP/500, UDP/4500, TCP/443 and, where used, TCP/80), limited to the clients' address ranges where possible (Check Point, sk1000117, updated 2026-09-24) (Check Point, sk1000118, updated 2026-09-18). It is for systems that cannot take the fix, carries the vendor's warning that a wrong rule set breaks connectivity, and does not apply to the locally managed Spark Firewall (Check Point, sk1000117, updated 2026-09-24) (Check Point, sk1000118, updated 2026-09-18). For CVE-2026-85102, sk1000117 now narrows the Site-to-Site exposure to gateways that use or allow certificate-based authentication. Gateways that participate only in communities authenticating with pre-shared keys are not vulnerable, while a community with dynamic-IP or Large Scale VPN gateways enables certificate authentication (Check Point, sk1000117, updated 2026-09-24).

A Management Server brought only to the minimum fix builds is not finished. Check Point lists Security Management at R82.10 Jumbo Hotfix Take 44 or lower, R82 Take 126 or lower, R81.20 Take 166 or lower and R81.10 Take 190 or lower as affected by CVE-2026-93616, a separate pre-authentication management flaw it has seen exploited (Check Point Research, 2026-09-22). The highest affected builds are the minimum fix builds listed above, so a server at exactly that level still needs the other flaw's own fix.

Builds on: Check Point patches a management-server zero-day it says has already been used in a handful of…

vulnerability10 Sep 04:45Zmulti-sourceOpen finding →
Sources: Check Point (vendor advisory sk1000118) · Check Point (vendor advisory sk1000117) · Forkast News · Check Point Research (blog) · The Hacker News · CISA KEV

2026-09-18 · view entry permalink →

HIGHCVE-2026-91843updatedNATOA2

CVE-2026-91843, Check Point Security Management / Multi-Domain Security Management / Log Server: unauthenticated stack overflow in the login process reaches root RCE (CVSS 9.8)

Check Point disclosed CVE-2026-91843 (CVSS 9.8) on 2026-09-16: a stack overflow in the unauthenticated login process to Check Point Security Management Server, Multi-Domain Security Management Server, Log Server and Multi-Domain Log Server lets an attacker who reaches the login interface run arbitrary code remotely as root (Check Point PSIRT, 2026-09-16). Check Point's attack indicator is a failed administrator login for an over-long username (Check Point PSIRT, 2026-09-16). Neither Check Point's advisory nor CERT-FR reports observed exploitation (Check Point PSIRT, 2026-09-16 · CERT-FR CERTFR-2026-AVI-1193, 2026-09-17).

Check Point ships the fix as a LivePatch: administrators with automatic updates enabled per sk175504 are already protected, and cplp list in Expert mode should show the CVE-2026-91843 patch armed on R82.20, R82.10, R82 and R81.20 (Check Point PSIRT, 2026-09-16). The fix is also in the Jumbo Hotfix Accumulator for R82.10 from Take 45, R82 from Take 127, R81.20 from Take 170 and the end-of-support R81.10 from Take 192, while Check Point lists no fix for R80.x and R81 (Check Point PSIRT, 2026-09-16). Check Point's mitigation is to limit Trusted Clients (GUI clients) to trusted IP addresses or subnets and never to use "Any" as the client type (Check Point PSIRT, 2026-09-16). The flaw needs no credentials and yields root (Check Point PSIRT, 2026-09-16), so the absence of exploitation reports does not lower the urgency.

Triage: Check Point's advisory for CVE-2026-93616 treats a login with a username over 1,000 characters that coincides with an FWM or MDS core dump as a potential attempt to exploit that flaw (Check Point Support, sk1000171, 2026-09-20). For CVE-2026-91843, Check Point gives only the "Username too long" login failure as its attack indicator (Check Point PSIRT, 2026-09-16).

A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.

In SmartConsole, search for Audit and Admin login logs containing the message: "Administrator failed to log in: Username too long".

Check Point PSIRT (sk1000155) 2026-09-16
Correctionrun 2026-09-30T0639Z-auditreferencessourcesbodysummarycvesactionsheadline

The LivePatch for this flaw does not cover CVE-2026-93616, a separate pre-authentication directory traversal and file upload flaw in Security Management, Multi-Domain Security Management, Log, Multi-Domain Log and SmartEvent servers, for which Check Point says no LivePatch is available (Check Point Support, sk1000171, 2026-09-20). Check Point says it was exploited in a handful of targeted attacks on July 23 (The Hacker News, 2026-09-22). That flaw needs the R82.20 Security Hotfix or a Jumbo Hotfix take (R82.10 Take 45, R82 Take 127, R81.20 Take 170 or R81.10 Take 192), and these takes also include the CVE-2026-91843 fix (Check Point Support, sk1000171, 2026-09-20). A server that received only this LivePatch is still exposed. R81.10 is fixable through Jumbo Hotfix Take 192, and only R80.x and R81 have no listed fix (Check Point PSIRT, 2026-09-16). Check Point's hunting guidance for CVE-2026-93616 includes searching cpm.elg for login requests with usernames over 1,000 characters and checking for an FWM or MDS core dump at the same time (Check Point Support, sk1000171, 2026-09-20).

Builds on: Check Point patches a management-server zero-day it says has already been used in a handful of…

vulnerability18 Sep 04:50Zmulti-sourceOpen finding →
Sources: Check Point PSIRT (sk1000155) · BSI CERT-Bund (WID-SEC-2026-3429) · CERT-FR (CERTFR-2026-AVI-1193) · The Hacker News · Check Point Support (sk1000171)

Earlier coverage (2)

2026-08-05HIGHNATOA2CVE-2026-18574, Check Point Security Management: unauthenticated bypass of management authentication to arbitrary command execution, with no fix for seven end-of-support trainsCheck Point disclosed CVE-2026-18574 in sk185222 (created 2026-08-01, last modified 2026-08-03): an unauthenticated attacker with network reach to a Security Management or Multi-Domain Security Management Server can bypass management authentication and execute arbitrary commands, which Check Point states could result in full compromise of the management system. Fixes ship in the Jumbo Hotfix Accumulator for R81.20 (Take 161), R82 (Take 122) and R82.10 (Take 40), but the advisory also lists R80, R80.10, R80.20, R80.30, R80.40, R81 and R81.10 as affected, all end-of-support, with no fix on offer. It is the fourth CVE disclosed on this management surface in roughly two weeks, and the second of them an authentication bypass.2026-07-23HIGHexploitedupdatedNATOA1CVE-2026-16232, Check Point SmartConsole: authentication bypass to full admin, exploited in the wild (CVSS 9.1)CVE-2026-16232 (CVSS 9.1) is an authentication-bypass flaw in the Check Point SmartConsole login process of Security Management and Multi-Domain Security Management (R81.10, R81.20, R82, R82.10+). An unauthenticated attacker who can reach an internet-exposed Management Server with no Trusted-Clients restriction obtains an application login token and authenticates as a full administrator; Check Point confirms active exploitation against a handful of customers with that specific exposure, CISA added it to KEV on 2026-07-22, and a same-day Jumbo Hotfix is available.

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns5

Source distribution

  • support.checkpoint.com8 (33%)
  • cert.ssi.gouv.fr3 (12%)
  • blog.checkpoint.com2 (8%)
  • cisa.gov2 (8%)
  • wid.cert-bund.de2 (8%)
  • advisories.ncsc.nl1 (4%)
  • bishopfox.com1 (4%)
  • euvd.enisa.europa.eu1 (4%)
  • other4 (17%)
All cited sources (24)