Check Point Spark Firewall

CISA added CVE-2026-85102 to its Known Exploited Vulnerabilities catalog on 2026-09-22 (CISA KEV, catalogue version 2026.09.22), and Check Point's own advisory confirms the reason: "Check Point disclosed the vulnerability and released fixes on September 9, 2026. At the time, we had no evidence of exploitation. We are now observing exploitation attempts against Check Point Spark customers globally" (Check Point Research, 2026-09-22). "Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers. The attempts originated from anonymization infrastructure, including VPN services and proxies" (Check Point Research, 2026-09-22), three days after the 2026-09-09 fix shipped. Check Point's own advisory sk1000117 carries a September 14 update explaining why some already-patched customers remained exposed during that wave: for customers who installed the Offline LivePatch Package while running R82.10 Jumbo Hotfix Take 24 or lower, R82 Jumbo Hotfix Take 107 or lower, or R81.20 Jumbo Hotfix Take 146 or lower, "following additional research, we identified a rare scenario in which customers must install Check Point Live Patch Take 26, which provides enhanced coverage for this CVE" (Check Point Support, sk1000117, updated 2026-09-14), a coverage gap in the original fix, closed by a second, hardened LivePatch issued five days after the initial patch and two days after exploitation attempts began. CVE-2026-85103, the companion heap-overflow certificate-decoding flaw, is unaffected by this gap and remains not confirmed exploited. Check Point's own hunting guidance: review logs for anomalous certificate-based Mobile Access logins without limiting the search to the observed certificate subjects, and treat follow-on internal port or service scanning from a logged-in Mobile Access session as second-stage activity warranting investigation.

Check Point's revision of sk1000118 on 2026-09-18 widens the population that needs CVE-2026-85103's fix. Its clarification reads: "All Security Management Server deployments are vulnerable, regardless of configuration, and require the fix described below". The flaw does not depend on any management configuration, and a management server is vulnerable even when VPN is neither used nor configured. The advisory now also lists the Spark Firewall among the affected products, and the R81.10 Jumbo Hotfix Accumulator from Take 190 carries the fix (Check Point, sk1000118, updated 2026-09-18). A Management Server that was left out of the patch round because it terminates no VPN is therefore in scope.

Both advisories now also give an interim mitigation for Remote Access VPN, which this entry had said did not exist: disable the Remote Access VPN implied rules and create explicit access rules for the services the clients need (UDP/500, UDP/4500, TCP/443 and, where used, TCP/80), limited to the clients' address ranges where possible (Check Point, sk1000117, updated 2026-09-24) (Check Point, sk1000118, updated 2026-09-18). It is for systems that cannot take the fix, carries the vendor's warning that a wrong rule set breaks connectivity, and does not apply to the locally managed Spark Firewall (Check Point, sk1000117, updated 2026-09-24) (Check Point, sk1000118, updated 2026-09-18). For CVE-2026-85102, sk1000117 now narrows the Site-to-Site exposure to gateways that use or allow certificate-based authentication. Gateways that participate only in communities authenticating with pre-shared keys are not vulnerable, while a community with dynamic-IP or Large Scale VPN gateways enables certificate authentication (Check Point, sk1000117, updated 2026-09-24).

A Management Server brought only to the minimum fix builds is not finished. Check Point lists Security Management at R82.10 Jumbo Hotfix Take 44 or lower, R82 Take 126 or lower, R81.20 Take 166 or lower and R81.10 Take 190 or lower as affected by CVE-2026-93616, a separate pre-authentication management flaw it has seen exploited (Check Point Research, 2026-09-22). The highest affected builds are the minimum fix builds listed above, so a server at exactly that level still needs the other flaw's own fix.

NCSC-NL updated its advisory (NCSC-2026-0179, version 1.0.1) on 2026-06-16 to note that public proof-of-concept code is now available for the Check Point Security Gateway IKEv1 authentication bypass (CVE-2026-50751), increasing the probability of exploitation (NCSC-NL, 2026-06-16). NCSC-NL scores the two flaws at CVSS v4 6.9 and 6.3, against Check Point's 9.3 and 7.4 (NCSC-NL, 2026-06-16).

The flaw lets an unauthenticated client abuse the IKEv1 negotiation to bypass peer-signature verification and impersonate any VPN identity configured for certificate or mixed authentication (username/password-only configurations are not affected); the public PoC follows watchTowr's earlier technical analysis (Help Net Security, 2026-06-12). Apply the early-June Check Point hotfix; where feasible disable IKEv1 legacy mode or enforce mandatory machine-certificate authentication, which is not bypassable by this flaw.