Two weeks ago it was a routine advisory. This week it's an incident. Check Point has confirmed active exploitation of CVE-2026-85102 — a CVSS 9.8 pre-authentication remote code execution flaw in the VPN certificate-handling code of its Quantum Security Gateway line — and paired it with a second problem that's arguably worse: CVE-2026-93616, a pre-authentication path traversal in the management web service that ends in arbitrary-path script execution and Java class loading. Both flaws are now listed in CISA's Known Exploited Vulnerabilities catalog, which is the federal government's way of saying: attackers are doing this for real, and patching stopped being optional the day the advisory landed.
The timeline is the part every network admin should internalize. Check Point disclosed both vulnerabilities and shipped fixes on September 9, 2026 — at the time stating there was no evidence of exploitation. Two weeks later, that reassurance expired. The window between "patch available" and "exploit in the wild" is where most breaches live, and this one is a textbook case: the same pattern we documented in the StyleSmuggler Magento zero-day and September's record Patch Tuesday breakdown. Here's what each flaw actually is, who's exposed, and the response order that matters.
What CVE-2026-85102 Actually Is
The National Vulnerability Database description is one sentence, and like most one-sentence descriptions of 9.8s, it understates the blast radius: improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. Read that again with the deployment model in mind. The VPN termination point is, by design, the one server in your organization that must accept connections from the entire internet. It performs cryptographic handshakes with strangers every second of every day. When the code that validates those handshake certificates can be steered into executing code, the "trusted gateway" becomes the attacker's beachhead — pre-authentication, no credentials, no user in the loop.
Affected deployments span the R81 and R82 release branches of Security Gateway, including centrally and locally managed Spark Firewall deployments. Check Point's original fixes landed September 9 in the Jumbo Hotfix Accumulator takes; the confirmation of in-the-wild exploitation arrived roughly two weeks later, and the flaw has since been added to the KEV catalog. If your gateway terminates VPN for remote workers, site-to-site tunnels, or partner access — and which enterprise doesn't run at least one of those — treat this as an active incident response, not a maintenance patch.
CVE-2026-93616: The Management Server Problem
The second flaw shifts the target from the data plane to the control plane. CVE-2026-93616 is a pre-authentication path traversal in the Check Point management web service — the interface administrators use to push policies, manage certificates, and configure every gateway in the estate. A path traversal flaw that a low-complexity attack can steer into arbitrary-path script execution and Java class loading on the management server is about as bad as web service bugs get, because the management server is the crown-jewel-of-crown-jewels: whoever controls it can reconfigure, disable, or repurpose every security gateway it manages.
Check Point's response here is specific: an R82.20 Security Hotfix, with the fix folded into the Jumbo Hotfix Accumulator for R82.10 (Take 45), R82 (Take 127), R81.20 (Take 170), and R81.10 (Take 192). Mitigation options exist for organizations that can't hotfix immediately — primarily restricting which networks can reach the management web service — but mitigations for a pre-auth path traversal on a management plane are a tourniquet, not a cure. One operational trap worth flagging: Check Point notes the VPN-related mitigations do not apply to locally managed Spark firewalls, so branch-office boxes need their own patch path rather than inheriting the datacenter's.
The VPN Gateway Is the Front Door Again
Zoom out and this is 2026's most persistent infrastructure pattern. Pre-auth RCE in VPN and edge appliances has produced a near-unbroken series of KEV additions since 2023 — Ivanti, Fortinet, Palo Alto, Citrix, and now Check Point — because the economics are irresistible to attackers. Edge devices are internet-reachable by definition, frequently under-patched (nobody wants to bounce a production VPN at 2 p.m.), and sit at the perfect network position: outside the perimeter's trust assumptions but inside its routing. A pre-auth RCE on a VPN gateway is the closest thing the modern network has to an unlocked front door with the alarm panel mounted outside.
The certificate-handling angle deserves its own note. Certificate parsing and trust validation is historically rich attack surface — it's code that runs before authentication by necessity, processing complex, attacker-supplied cryptographic structures. Every vendor in the VPN business carries some version of this liability, and the remediation lesson generalizes far beyond Check Point: anything that terminates TLS or IKE from untrusted networks must be on the shortest patch SLA you run. Our zero-trust approach to VPN vulnerabilities covers the architectural side of shrinking that surface.
Lock the admin path while you patch the gateway
Gateway and management-server admin accounts are exactly the targets phishing-resistant authentication was built for. A hardware FIDO2 security key from Amazon for every admin account on your edge infrastructure is cheap insurance — our best security key for FIDO2 guide compares the options.
Who's Exposed, and What to Do First
If you run Check Point Quantum Security Gateway, Spark Firewall, or a Security Management Server on an affected R81/R82 branch, here's the order of operations we'd follow — the same triage structure as our free Zero-Day Emergency Response Playbook:
- Patch the management server first. It's the higher-consequence target (CVE-2026-93616), and compromising it compromises everything it manages. R82.20 hotfix or the listed Jumbo takes.
- Patch gateways second, internet-facing first. Any Quantum Security Gateway terminating VPN from untrusted networks goes before internal-only boxes.
- Restrict management-plane exposure immediately if you can't patch yet: the management web service should be reachable only from a dedicated admin network or jump host — never from the internet, and honestly never from the general LAN either.
- Hunt, don't just patch. Both flaws have been exploitable in the wild since at least the KEV listing. Review VPN negotiation and management web service logs for anomalies, unexpected process launches, and outbound connections from gateway or management hosts during the exposure window. On a KEV-listed pre-auth RCE, "we patched it" is not the finish line — assume compromise until the logs say otherwise.
- Handle Spark separately. Locally managed Spark firewalls don't inherit the standard mitigations — schedule their own upgrade path.
The Bottom Line
CVE-2026-85102 and CVE-2026-93616 tell one story in two acts: a vendor patched on time (September 9), and attackers caught up two weeks later anyway. That two-week gap is now the standard exploitation window for critical edge-infrastructure flaws — which means the entire "patch within 30 days" compliance mindset is calibrated for a threat that no longer exists. The gateways you expose to the internet need patching measured in days, admin accounts protected with phishing-resistant MFA, and a management plane that's architecturally unreachable from anywhere an attacker might stand. Check Point customers: patch this weekend, hunt afterward. Everyone else: look at your own edge devices and ask what two-week window you're currently exposed in.
Disclosure: This post contains affiliate links. We may earn a commission on purchases at no extra cost to you. See our affiliate disclosure for details.
Get weekly AI & security infrastructure guides
Join the GeniusTechLab newsletter for AI infrastructure breakdowns, security analysis, and hardware recommendations — one email a week, no spam.
Subscribe to the newsletter →