CVE-2026-93616 "has been exploited as a zero-day since July 23," Check Point reports — and the vendor now says attacks exploiting a second VPN-related defect began actively targeting customers on September 12, 2026.
The two flaws at the center: CVE-2026-85102 and CVE-2026-93616
Check Point, a cybersecurity company, confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product. The advisory also warns of exploitation of CVE-2026-93616, a pre-authentication path traversal flaw that impacts the Management web service and can allow script execution and Java class loading. Check Point said CVE-2026-93616 "has been exploited as a zero-day since July 23."
Observed attacker behavior and indicators
Check Point reported a visible wave of activity beginning on September 12, 2026: "Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers," the company wrote. "The attempts originated from anonymization infrastructure, including VPN services and proxies." The vendor also disclosed that attackers used certificates with the following subjects during observed attempts:
- CN=vpn,OU=users,O=global
- CN=vpn-user,OU=users,O=global
- CN=vpnuser,OU=users,O=global
Check Point cautioned that those three subjects "only reflect current observations and more may be in use." The company additionally noted that attackers were using VPNs and proxies to hide their location.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageVendor guidance: patches, LivePatch, and configuration mitigations
Check Point provided concrete remediation steps. For CVE-2026-85102 it recommended installing Check Point LivePatch Take 26 on supported R81.20, R82, or R82.10 gateways, or installing a fixed Jumbo Hotfix: R81.20 Take 166, R82 Take 126, R82.10 Take 44, or R81.10 Take 190, or later. Customers should also update Spark firewalls to R82.00.10 Build 2325 or R81.10.17 Build 4968, or later.
System administrators were advised to verify LivePatch status on the Security Gateway by running the command cpinfo -y CPupdates in expert mode. Check Point specifically warned that some customers who installed an earlier offline LivePatch package need Take 26 for full coverage.
If updating is not possible, Check Point recommended configuration mitigations: disable VPN implied rules and create explicit rules that restrict Site-to-Site VPN on UDP/500 and UDP/4500 to specific peer IP addresses. For Remote Access VPN, allow only the required services over UDP/500, UDP/4500, TCP/443, and TCP/80 where applicable, and restrict source client IP ranges where possible. The advisory noted these mitigation measures do not apply to locally managed Spark firewalls.
CISA action and timeline for federal agencies
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added both CVE-2026-85102 and CVE-2026-93616 to its Known Exploited Vulnerabilities (KEV) catalog and urged federal agencies to apply available fixes and/or mitigations by September 25, 2026.
How federal agencies, security teams, and affected enterprises are likely to respond
- Federal agencies: face a CISA KEV-driven deadline — CISA "urged federal agencies to apply the available fixes and/or mitigations by September 25, 2026," making timely patching or configuration changes a near-term compliance task.
- Security teams and technologists: must verify LivePatch deployment (use cpinfo -y CPupdates), ensure Spark firewall builds meet the R82.00.10 Build 2325 or R81.10.17 Build 4968 thresholds, and if unable to patch, implement the explicit VPN rule restrictions on UDP/500 and UDP/4500 and tighten Remote Access VPN source ranges.
- Affected enterprises and Check Point customers: Spark customers were explicitly targeted in the observed "wave of exploitation attempts," so organizations running Spark or Security Gateway appliances will need to assess exposure quickly and apply the vendor-specified Hotfixes or LivePatch Take 26.
Check Point also pointed customers seeking mitigation and hunting advice for the Management web service CVE-2026-93616 to a support article maintained by the vendor.
The factual arc is compact: a zero-day in the Management web service has been exploited since July 23, a related VPN certificate-handling RCE began being exploited in mid-September, and both flaws are now listed in CISA's KEV with a federal remediation timeline that expires on September 25, 2026. The concrete next step named in the record is clear — apply the specific LivePatch or Jumbo Hotfix takes and Spark builds, or implement the explicit VPN restrictions — and the open question the facts leave is whether organizations will complete that work before the KEV deadline.
