Check Point has publicly acknowledged that critical vulnerabilities have emerged in its Security Gateway and Management products, which handle network protection for numerous organizations. This revelation is significant as it underscores a scenario where a security solution itself can be manipulated by attackers. The firm has indicated that the vulnerabilities are being actively exploited, necessitating immediate remediation.
The vulnerabilities include a remote code execution (RCE) loophole identified as CVE-2026-85102 in the Check Point Spark firewall, disclosed on September 9. In tandem, a zero-day pre-authentication vulnerability named CVE-2026-93616 was also discovered in the Security Management web service. Both of these flaws carry a CVSS rating of 9.8, reflecting their severity.
Frank Dickson from Dickson Research emphasized the gravity of these vulnerabilities, noting that both flaws grant access to attackers without requiring any credentials. This effectively positions them at the highest threat level for firewall vendors.
Access Without Authentication
What’s particularly alarming about these vulnerabilities is that they are pre-authentication; attackers can exploit them without a username or password. Aaron Beardslee, a threat research manager at Securonix, explained that with CVE-2026-85102, an attacker can gain access simply by presenting a malicious certificate during the initial VPN negotiation. Essentially, the gateway, in that scenario, performs all actions, compromising its role as a defender.
This pre-auth exploitation means that if attackers successfully execute malicious code, they're immediately placed on a secure side of the network. As Beardslee aptly put it, they’re able to walk right through the VPN and start mapping the internal network. The implications are dire: sensitive companies with remote access systems may find their entire infrastructure at risk.
Meanwhile, CVE-2026-93616 allows attackers to execute scripts from arbitrary paths and load any Java classes they choose, presenting another major security risk. Despite limited exploitation so far, Beardslee pointed out that this vulnerability is "arguably worse in impact," as it allows a breach into the core management server—essentially the "brain" of Check Point’s network security ecosystem.
If compromised, attackers could potentially alter firewall policies, opening unwarranted entry points into the organization while capturing critical configuration data. The ability to dictate firewall behavior rather than circumventing it presents a profound threat to systems designed to keep intruders out.
The prolonged window from vulnerability detection to patch deployment is also concerning; Check Point initially observed malicious activity on July 23 before solutions were made available in September, leaving an extensive period for attackers to exploit the flaws.
Security Products Are Not Flawless
These incidents serve as a stark reminder that security appliances, while intended to block threats, are not invulnerable to vulnerabilities themselves. Beardslee pointed out that as software products, firewalls inherently harbor bugs, and organizations often misclassify these devices as infallible appliances that don’t demand the rigorous monitoring typical of other internet-facing servers.
On the contrary, attackers perceive these devices as prime targets—privileged, exposed, and frequently lacking the robust telemetry applied to other systems in the enterprise. The fact that simple, time-tested exploits like path traversal are still effective in 2026 suggests assailants are utilizing dependable tactics against under-scrutinized targets.
Backing Beardslee's insights, Dickson asserted that security mechanisms, meant to thwart intrusions, are ironically among the most attractive targets due to their essential trustworthiness and knowledge of the infrastructure they protect.
Moreover, when breaches occur at perimeter security points—devices explicitly designed to combat attackers—response time is critical. Dickson highlighted the rapid exploitation of vulnerabilities like CVE-2026-85102, which was under attack within just three days post-disclosure.
Strategies for Enterprises
Given the notable security ramifications, Check Point has urged enterprises to actively monitor logs for unusual patterns, like certificate-based Mobile Access logins and any internal scans originating from suspicious users. Ensuring that management consoles are not accessible over the public internet can significantly mitigate risks. Dickson stressed the importance of removing these consoles from direct reach to lower the chances of exploitability.
He added another layer of strategy by recommending proactive hunting for any signs of compromise rather than relying solely on patches. Firms need to scrutinize the access patterns and behaviors that can signal an ongoing breach, particularly environments where compromised management servers could lead to multiplatform exploitation.
Companies should also consider segregating their patch service level agreements (SLAs) for security infrastructure so that their urgency aligns with the real-time threat landscape rather than the typical slower IT patch cycles. The Known Exploited Vulnerabilities (KVE) catalog should be utilized as a prompt for vigilance, as these indicators often reveal active exploitation.
In conclusion, Beardslee underscored the necessity for thorough vetting of pre-auth code and advised keeping management systems off the open internet, fortifying defenses while vigilantly monitoring for signs of potential compromise. Awareness of behavioral indicators, rather than solely relying on traditional signature-based alerts, will be key in maintaining security integrity in an increasingly complex threat environment.
