Critical 9.8Being exploited
Check Point · Quantum Security Gateway and Spark Firewall · CVE-2026-85102
Check Point and Spark firewalls with VPN enabled attacked through certificate checks
Weak certificate validation during VPN negotiation lets an unauthenticated attacker run code on Check Point gateways using site-to-site or remote access VPN. Check Point fixed it on 9 September, then confirmed on 22 September that attacks against Spark customers had begun on 12 September. In the same advisory it disclosed CVE-2026-93616 (CVSS 9.8), a separately exploited pre-login flaw in Check Point Security Management servers.
- Affected
- Security Gateway and Spark Firewall (centrally and locally managed) on R81, R81.10, R81.10.X, R81.20, R82, R82.00.X and R82.10. For CVE-2026-93616: Security Management on R82.10 Jumbo Hotfix Take 44 or lower, R82 Take 126 or lower, R81.20 Take 166 or lower, and older end-of-support releases.
- What to do
- Apply the fix Check Point released on 9 September (SK1000117) to gateways and Spark appliances, and the Jumbo hotfix in SK1000171 to management servers (Check Point notes LivePatch Take 28/29 does not fix CVE-2026-93616). Review logs for unusual certificate-based Mobile Access logins.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
- Why it’s here
- Exploited; on CISA's KEV list; Spark is Check Point's firewall line for small and medium businesses.