On September 22, 2026, CISA added two Check Point vulnerabilities to its KEV catalog with a three-day deadline. Both rated 9.8, both unauthenticated, and they hit the two halves of a Check Point architecture: the gateways filtering traffic, and the server administering them.
| CVE | Target | Nature | NVD published | KEV added |
|---|---|---|---|---|
| CVE-2026-85102 | Security Gateway, Spark (VPN) | Improper certificate validation → RCE | 2026-09-09 | 2026-09-22 |
| CVE-2026-93616 | Management Server, Log Server, SmartEvent | Directory traversal + upload → script execution | 2026-09-22 | 2026-09-22 |
Shared vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CISA deadline: 2026-09-25.
CVE-2026-93616 entered KEV on the day it was published: exploitation preceded the fix.
It's the third Check Point CVE in KEV this summer, after SmartConsole in July.
CVE-2026-85102 — the VPN trusts the wrong certificate
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
CISA narrows the scope: gateways using site-to-site or remote access VPN.
VPN negotiation happens before any user authentication, and must be internet-reachable by definition. A certificate-validation flaw at that step therefore hits the one gateway component you can't hide behind an access list.
| Platform | Affected versions per NVD |
|---|---|
| Gaia OS | R81.10, R81.20, R82, R82.10 |
| Gaia Embedded (Spark) | R81.10.17, R82.00.10 |
CVE-2026-93616 — dropping a script on the management server
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
Affects: Security Management Server, Multi-Domain Security Management, Log Server, Multi-Domain Log Server and SmartEvent — versions R81.10, R81.20, R82, R82.10, R82.20.
The management server is the heart of a Check Point deployment: it holds the security policy for every gateway and pushes it to them. An attacker executing code there can rewrite filtering policy across the whole estate — open rules, disable logging, create VPN access — without ever touching a gateway directly.
Versions and Fixes
Check Point ships fixes through version-specific Jumbo Hotfix Accumulators. The numbers above are the affected branches NVD publishes, not fixed versions: check the Check Point advisory (sk) for the hotfix applicable to your branch.
# On the gateway or management (expert mode)
fw ver
cpinfo -y all | grep -i jumbo
Detection
Gateways (CVE-2026-85102)
- Crashes or restarts of VPN processes (
vpnd,iked) — a failed booby-trapped negotiation takes the daemon down - Tunnels established with unknown peers or unexpected certificates:
vpn tu - Unknown processes or files in expert mode
Management (CVE-2026-93616)
- Recently created files in the management server's web and script directories
- Policy installations not tied to a change request — this is the signal that matters
- Administrator accounts or objects recently created in SmartConsole
- Interrupted logging or modified log rules
Mitigation
- Install the fixed Jumbo Hotfix for your branch — the CISA deadline was September 25.
- Management Server: must never be internet-reachable. Restrict access to admin workstations and gateways (Trusted Clients).
- Gateways: restrict site-to-site VPN negotiation to known peer addresses where possible.
- If management was compromised: audit the policy installed on every gateway, rotate SIC, certificates and admin accounts.
Why Continuous Monitoring of Firewalls and Their Management Matters
Three Check Point CVEs in KEV in three months, one exploited before publication. On this class of device, the question isn't whether a critical CVE will arrive, but how long it takes to know which branches in your estate are affected.
With cveo.tech, inventory your Check Point gateways and management servers with exact versions, and get alerted whenever a KEV-listed CVE affects them.