Check Point Discloses Zero-Day Exploit in Security Management Server
Critical vulnerability allowed script execution without authentication in targeted attacks.
1Critical zero-day exploited
Check Point confirmed attackers exploited an unpatched vulnerability (CVE-2026-93616) in its Security Management Server on July 23. The path traversal flaw allows unauthenticated script execution through the web service interface. Rated 9.8/10 on CVSS scale, it affects multiple server versions including R82.20. The company released fixes on September 22 for this critical vulnerability that controls firewall policies across Check Point gateways.
2Attack mechanism
The vulnerability stems from improper file/folder access restrictions in the management server's web service. Attackers can upload and execute malicious scripts without authentication. Check Point's advisory doesn't disclose attack targets or post-exploit activities. The flaw remained unpatched for two months despite being actively exploited in targeted attacks before disclosure.
3Parallel VPN attacks
Separately, attackers attempted to exploit CVE-2026-85102, a VPN certificate flaw patched on September 9. These attempts targeted Spark firewall customers since September 12. The vulnerability allows code execution on gateways during VPN setup without login. Affected products include Security Gateway and Spark firewalls across multiple versions, including end-of-support R81 and R81.10.
4Patch complications
Check Point uses dual update channels: Jumbo Hotfix (numbered by 'Take') and LivePatch for urgent fixes. CVE-2026-93616 requires specific hotfixes, while LivePatch Take 28/29 addressed different vulnerability (CVE-2026-91843). Administrators must verify they've applied correct patches, as servers patched for September's VPN flaw remain vulnerable to the zero-day.
5Vulnerability scope
The management server flaw affects both centrally and locally managed systems. Netherlands' NCSC confirmed impact when products use Site-to-Site or Remote Access VPN. Attackers used anonymizing infrastructure (VPNs/proxies) with specific certificate subjects, though Check Point warns the list isn't exhaustive. Unpatched systems remain vulnerable to both web service and VPN attacks.
6Detection challenges
Check Point advises monitoring for unusual certificate-based Mobile Access logins beyond known malicious subjects. Post-login activities often include internal port scanning. While September 9 VPN fixes provide protection, the company hasn't confirmed if any exploitation attempts succeeded. The advisory lacks details about required network access for attacks.
7Mitigation strategies
For unpatched gateways, NCSC recommends disabling implied VPN rules and restricting UDP ports 500/4500 to specific peer IPs (not applicable to local Spark firewalls). Check Point provides hunting guidance and IoCs in support articles sk1000171 and sk1000117. Administrators must verify patch levels across all management components to prevent exploitation.
8Enterprise security implications
These incidents highlight critical gaps in patch management for security infrastructure. The two-month window between exploitation and patch for the zero-day, plus simultaneous VPN attacks, demonstrate sophisticated threat actor persistence. Organizations must prioritize immediate patching of Check Point systems and enhance monitoring for anomalous certificate-based access patterns.