Reported by 25 outlets

Timeline

1. original reporting

   A critical exploited Check Point Management vulnerability (CVE-2026-93616) allows attackers to execute arbitrary scripts. Secure your server

   securityonline.info · 21d ago · September 22nd, 2026

   A critical exploited Check Point Management vulnerability (CVE-2026-93616) allows attackers to execute arbitrary scripts. Secure your server

   via Mastodon https://securityonline.info/exploited-cve-2026-93616-checkpoint-scripts/?utm_source=mastodon&utm_medium=jetpack_social

2. update from beazley.security

   Critical Remote Code Execution Vulnerabilities in Check Point Quantum Security Gateway and Security Management (Beazley Security)

   beazley.security · 35d ago · September 9th, 2026

   Beazley Security published an advisory dated September 9, 2026 reporting that Check Point had released emergency updates that day for two critical VPN certificate-handling vulnerabilities. It describes CVE-2026-85103 as a heap overflow in VPN certificate ASN.1 decoding affecting Security Gateways and Security Management systems, and CVE-2026-85102 as improper certificate validation during VPN negotiation, both CVSS 9.8, with fixes delivered through LivePatch and the Jumbo Hotfix Accumulator.

3. update from community.checkpoint.com

   Action Required: Critical Security Advisory - VPN Vulnerabilities (Check Point CheckMates community)

   community.checkpoint.com · 34d ago · September 10th, 2026

   A Check Point community post dated September 10, 2026 states that the Check Point research team identified and remediated two critical VPN-related vulnerabilities, CVE-2026-85102 and CVE-2026-85103. It is the vendor's early customer-facing notice twelve days before the September 22 security alert that also disclosed CVE-2026-93616.

4. update from advisories.ncsc.nl

   Security Advisory NCSC-2026-0365: kwetsbaarheden verholpen in Check Point VPN-producten (NCSC-NL)

   advisories.ncsc.nl · 33d ago · September 10th, 2026

   The Dutch National Cyber Security Centre published advisory NCSC-2026-0365, initial version 1.0.0 on September 10, 2026 at 09:12 Europe/Amsterdam, covering CVE-2026-85102 and CVE-2026-85103 in Quantum Security Gateway and Security Management, both CVSS 9.8. The NCSC stated it expected large-scale exploitation attempts in the short term and urged organizations to follow Check Point's advisory urgently; a September 23 revision recorded Check Point's confirmation that abuse of CVE-2026-85102 had been observed.

5. update from arcticwolf.com

   CVE-2026-85102 & CVE-2026-85103 (Arctic Wolf)

   arcticwolf.com · 30d ago · September 14th, 2026

   Arctic Wolf's September 14, 2026 blog on CVE-2026-85102 and CVE-2026-85103 states the two vulnerabilities were discovered internally by Check Point and first disclosed on September 7, 2026, with the vendor advisory updated afterward. The post provides context and detection guidance for the pair of CVSS 9.8 VPN flaws ahead of the CVE-2026-93616 disclosure.

6. update from support.checkpoint.com

   CVE-2026-93616: Directory Traversal and File upload allows execution of arbitrary script on the Management Server (Check Point sk1000171)

   support.checkpoint.com · 24d ago · September 20th, 2026

   Check Point's SecureKnowledge article for CVE-2026-93616 was created on September 20, 2026, two days before the public security alert, and last modified on September 22. It documents the CVSS 9.8 pre-authentication directory traversal and file upload flaw affecting Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent, states it is exploited in the wild with a handful of attacked customers, and provides grep-based IoC commands for cpm.elg logs, mitigation by restricting TCP/19009 to trusted IPs, and fixes in the R82.20 Security Hotfix and Jumbo Hotfix Accumulator takes 45, 127, 170 and 192.

7. update from bleepingcomputer.com

   Check Point warns of Management Server zero-day exploited in attacks

   bleepingcomputer.com · 21d ago · September 22nd, 2026

   Check Point Software released emergency hotfixes to address a critical Security Management Server vulnerability that could let attackers run arbitrary scripts. The Security Management Server is a central repository that stores and manages security policies, processes administrator changes, and collects system logs across enterprise networks. Tracked as CVE-2026-93616 , this path traversal flaw lets unauthenticated threat actors upload arbitrary scripts on vulnerable Check Point Management Servers and execute them in low-complexity attacks. The Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have urged software companies since May 2024 to remove path traversal weaknesses from their products before shipping, saying such security issues "have been called 'unforgivable' since at least 2007." Check Point has addressed the vulnerability in R82.20 Security Hotfix and said that the complete list of affected products includes Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Check Point is aware of a handful of customers who have been attacked," the company warned, while advising security teams to check their networks for evidence of successful exploitation using the indicators of compromise shared in this security advisory . Check Point also provides temporary mitigation measures for customers who can't immediately deploy the hotfix on vulnerable s

8. mentioned by www.bleepingcomputer.com

   🤖 CVE-2026-93616: Check Point Security Management Server path traversal zero-day exploited in the wild. Unauthenticated attackers can upload

   www.bleepingcomputer.com · 21d ago · September 22nd, 2026

9. mentioned by ifin.network

   Two Check Point critical vulnerabilities are now listed as exploited in the wild. https:// ifin.network/t/cve-2026-85102- and-93616-check-po

   ifin.network · 21d ago · September 22nd, 2026

10. mentioned by threat-intelligence.redeyesecurity.com

    Check Point Management Server zero-day: 61 days from exploit to fix. CVE-2026-93616 sat exploitable for two months. The management server is

    threat-intelligence.redeyesecurity.com · 21d ago · September 22nd, 2026

11. mentioned by blog.checkpoint.com

    https:// blog.checkpoint.com/security/s ecurity-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authenti

    blog.checkpoint.com · 21d ago · September 22nd, 2026

12. update from dev.to

    Check Point CVE-2026-93616: Actively Exploited Pre-Authentication Path Traversal Leading to Script Execution # security # threatintel # soft

    dev.to · 21d ago · September 23rd, 2026

    Check Point CVE-2026-93616: Actively Exploited Pre-Authentication Path Traversal Leading to Script Execution # security # threatintel # soft

    via Mastodon https://dev.to/anoymask/check-point-cve-2026-93616-actively-exploited-pre-authentication-path-traversal-leading-to-script-3ac1

13. update from gbhackers.com

    Hackers Exploit Check Point 0-Day Flaw to Execute Code on Management Servers

    gbhackers.com · 20d ago · September 23rd, 2026

    This issue affects multiple management-server products and is actively being exploited in the wild. The vulnerability has a CVSS […] The post Hackers Exploit Check Point 0-Day Flaw to Execute Code on Management Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

14. update from cyberwald.com

    Cyberwald podcast: cybersecurity news 23 Sept 2026 — Check Point zero-day CVE-2026-93616, Defender false alerts

    cyberwald.com · 20d ago · September 23rd, 2026

    Topics covered include Check Point Management Server zero-day CVE-2026-93616, Windows Defender false-alert issues, and other current vulnerability reports. The original German episode is available at the source link below. via Mastodon https://cyberwald.com/podcast/2026-09-23.podcast.ogg

15. update from securityweek.com

    Check Point Patches Exploited Management Server Zero-Day

    securityweek.com · 20d ago · September 23rd, 2026

    As a mitigation option, customers are advised to limit access to the Management Server behind a security gateway or a firewall and limit access to port TCP/19009 to trusted IP addresses. Check Point noted that standard LivePatch updates do not resolve CVE-2026-93616. Check Point also released indicators of compromise (IoCs) to help organizations hunt for potential exploitation. On Tuesday, the US cybersecurity agency CISA added the zero-day bug to its Known Exploited Vulnerabilities (KEV) cata

16. mentioned by thehackernews.com

    🤖 CVE-2026-93616: Check Point Security Management Server zero-day exploited in targeted attacks since July 23. Flaw in the management web se

    thehackernews.com · 20d ago · September 23rd, 2026

17. mentioned by cybertop.ai

    CYBERTOP AI detects CVE-2026-93616: Check Point products path traversal vulnerability actively exploited. Defend by applying latest patches

    cybertop.ai · 20d ago · September 23rd, 2026

18. mentioned by www.yazoul.net

    🚨 New security advisory: CVE-2026-93616 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • R

    www.yazoul.net · 20d ago · September 23rd, 2026

19. mentioned by www.yazoul.net

    🚨 New security advisory: CVE-2026-93616 affects multiple systems. • Impact: Remote code execution or complete system compromise possible • R

    www.yazoul.net · 20d ago · September 23rd, 2026

20. update from socprime.com

    CVE-2026-93616: Check Point Management Server Zero-Day Exploited in Targeted Attacks

    socprime.com · 20d ago · September 23rd, 2026

    The vulnerability combines path traversal with unsafe file-upload behavior in the Check Point Management web service. By escaping intended directory restrictions, an attacker can place malicious content in arbitrary locations and subsequently execute scripts or load an arbitrary Java class without authenticating to the management server. The security issue is especially significant because Check Point management infrastructure sits at the center of enterprise firewall administration, security policy management, administrator access, and logging. Compromise of such a system can provide attackers with a powerful foothold inside an organization’s security architecture. The company observed a handful of highly targeted attacks on July 23, 2026 , almost two months before patches became publicly available on September 22. Improper restric

21. mentioned by cyber.netsecops.io

    📰 Check Point Zero-Days in Management Servers and VPNs Under Active Attack CISA KEV Alert: Two critical Check Point zero-days (CVE-2026-9361

    cyber.netsecops.io · 20d ago · September 23rd, 2026

22. update from bleepingcomputer.com

    Check Point warns of hackers exploiting Security Gateway VPN RCE flaw

    bleepingcomputer.com · 20d ago · September 23rd, 2026

    Check Point has now confirmed that malicious activity started on September 12, with attackers using VPNs and proxies to hide their location. “Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers,” reads Check Point’s alert . “The attempts originated from anonymization infrastructure, including VPN services and proxies," the company said, adding that certificates with the following subjects were used: CN=vpn,OU=users,O=global CN=vpn-user,OU=users,O=global CN=vpnuser,OU=users,O=global However, the cybersecurity company noted that the three subjects only reflect current observations and more may be in use.

23. update from www.bleepingcomputer.com

    Check Point warns of hackers exploiting Security Gateway VPN RCE flaw https:// bleepingcomputer.com/news/security/ check-point-warns-of-hack

    www.bleepingcomputer.com · 20d ago · September 23rd, 2026

    Check Point warns of hackers exploiting Security Gateway VPN RCE flaw https:// bleepingcomputer.com/news/security/ check-point-warns-of-hack

    via X https://www.bleepingcomputer.com/news/security/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw/

24. mentioned by www.bleepingcomputer.com

    # CheckPoint warns of Management Server zero-day exploited in attacks https://www. bleepingcomputer.com/news/secu rity/check-point-patches-m

    www.bleepingcomputer.com · 20d ago · September 23rd, 2026

25. mentioned by cyberworldops.eu

    Check Point confirms active exploitation of CVE-2026-85102, unauthenticated RCE in Security Gateway VPN negotiation, and CVE-2026-93616, pat

    cyberworldops.eu · 20d ago · September 23rd, 2026

26. mentioned by www.bleepingcomputer.com

    🤖 CVE-2026-85102: pre-authentication RCE in Check Point Security Gateway VPN certificate handling, confirmed actively exploited in the wild.

    www.bleepingcomputer.com · 20d ago · September 23rd, 2026

27. mentioned by www.bleepingcomputer.com

    🤖 CVE-2026-85102: pre-auth RCE in Check Point Security Gateway VPN certificate handling, confirmed actively exploited in the wild. Check Poi

    www.bleepingcomputer.com · 19d ago · September 24th, 2026

28. mentioned by beyondmachines.net

    Check Point VPN Gateways and Management Server Flaws Actively Exploited Check Point confirmed active exploitation of three critical vulnerab

    beyondmachines.net · 19d ago · September 24th, 2026

29. update from cyberpress.org

    Critical Check Point VPN and Management Vulnerabilities Actively Exploited in Attacks

    cyberpress.org · 19d ago · September 24th, 2026

    The flaws, tracked as CVE-2026-85102 and CVE-2026-93616, both carry a CVSS severity score of 9.8 and enable unauthenticated attackers to gain code-execution capabilities in exposed environments. Check Point cautioned that these indicators are not comprehensive and defenders should investigate anomalous certificate-based Mobile Access logi

30. update from gbhackers.com

    Hackers Exploit Check Point VPN RCE and Management Zero-Day in Attacks

    gbhackers.com · 19d ago · September 24th, 2026

    Both vulnerabilities have a CVSS score of 9.8 and allow for pre-authentication attacks, making immediate patching and reducing exposure essential.

31. update from malware.news

    Active Exploitation of Check Point Security Gateway and Security Management Vulnerabilities

    malware.news · 18d ago · September 25th, 2026

    CVE CVE-2026-85102 CVE-2026-93616 Affected Products CVE-2026-85102: Security Gateway Spark Firewall (Centrally Managed) Spark Firewall (Locally Managed) Affected versions include: R81 (EoS) R81.10 (EoS) R81.10.X R81.20 R82 R82.00.X R82.10 CVE-2026-93616: Security Management Server Multi-Domain Security Management Server Log Server Multi-Domain Log Server SmartEvent Affected versions include: R82.20 R82.10 Jumbo Hotfix Take 44 or lower R82 Jumbo Hotfix Take 126 or lower R81.20 Jumbo Hotfix Take 166 or lower R81.10 Jumbo Hotfix Take 190 or lower (EoS) R80, R80.10, R80.20, R80.30, R80.40 and R81 (all EoS) Expl

32. mentioned by support.checkpoint.com

    CVE-2026-91843 Fix Check Point has released a fix for CVE-2026-91843, a critical vulnerability affecting Security Management and Log Servers

    support.checkpoint.com · 18d ago · September 25th, 2026

33. mentioned by www.truesec.com

    (truesec.com) Critical Check Point Vulnerabilities Under Active Exploitation: CVE-2026-85102 and CVE-2026-93616 In brief - This article deta

    www.truesec.com · 18d ago · September 25th, 2026

34. update from gbhackers.com

    CISA Adds Multiple Check Point Product Flaws to Exploited Vulnerabilities List

    gbhackers.com · 18d ago · September 25th, 2026

    Federal civilian agencies must address these vulnerabilities by September 25, 2026, under Binding Operational Directive (BOD) 26-04.

35. update from cyberpress.org

    CISA Warns of Check Point VPN and Management Flaws Exploited for Unauthenticated Code Execution

    cyberpress.org · 18d ago · September 25th, 2026

    Federal Civilian Executive Branch agencies were required to apply vendor-provided mitigations by September 25 under Binding Operational Directive 26-04, which prioritizes remediation based on exploitability and operational risk. Because VPN gateways commonly sit at the network perimeter and handle authentication, encrypted traffic, and remote access connections, successful exploitation could give an attacker a highly valuable foothold. An intruder that gains code execution on such a device may be able to alter traffic-handling rules, establish persistence, collect credentials, or use the gateway as a pivot point into internal environments.

36. mentioned by www.valtersit.com

    CVE-2026-93616 Check Point Management Server path traversal and file upload, unauth RCE, CVSS 9.8. Patch under review, so isolate exposed se

    www.valtersit.com · 11d ago · October 2nd, 2026