Check Point hacked: The security software protecting your network has become a prime attack target

A firewall is supposed to be the barrier between attackers and the enterprise network, but that barrier can itself become a threat actors’ tool. Check Point has revealed that attackers are actively exploiting two vulnerabilities in its Security Gateway and Security Management products.

The security software provider has warned that attackers are targeting CVE-2026-85102, a remote code execution (RCE) vulnerability in its Check Point Spark small business firewall disclosed on September 9. It also discovered a zero-day pre-authentication path vulnerability, CVE-2026-93616, in its Security Management web service.

Fixes are available for both vulnerabilities, and Check Point advises customers to install them immediately.

“Both are rated CVSS 9.8, and both let an attacker in without a username or password, which puts them in the worst category a firewall vendor can have,” said Frank Dickson of Dickson Research.

Handing attackers skeleton keys

Both flaws are pre-authentication, meaning an attacker never needs a username, password, or stolen session, explained Aaron Beardslee, manager of threat research at Securonix.

With CVE-2026-85102, the trigger arrives during initial VPN negotiation; the attacker need only hand the gateway a malicious certificate and the gateway does the rest. “The gateway is the front door, the lock, and the security guard all in one box,” Beardslee said.

Code execution puts attackers on the trusted side of the perimeter, sitting on the very system that brokers remote access for every employee. “In plain terms, the attackers are walking through the VPN and immediately mapping the internal network,” he said. 

CVE-2026-93616 could allow attackers to execute scripts from an arbitrary path and load an arbitrary Java class. Beardslee called it “arguably worse in impact,” even though exploitation so far has been narrow, because the management server is effectively the “brain” of a Check Point deployment.

“It writes and pushes policy to every gateway,” he said, so an attacker who accesses it could theoretically rewrite firewall rules, open paths into the network, and harvest configuration data about the entire architecture.

“You don’t need to break the firewall when you can tell it what to allow,” Beardslee said. He also pointed to the timeline: Check Point observed a few targeted attacks on July 23, but the fix didn’t ship until two months later, a huge window of zero-day exposure on “the most privileged box in the security stack.”

Dickson agreed that CVE-2026-93616 is the worst of the two in a “structural sense,” because an attacker who gets into one gateway has a foothold in the system. This gives them “the keys to every gateway that server controls,” he said. “That’s the difference between picking one lock and stealing the master key to the whole building.”

The security software conundrum

These vulnerabilities make it clear that security products, although meant to protect, are not immune to security flaws.

“Security products are software, and software has bugs,” Beardslee pointed out. Yet organizations tend to treat firewalls and their management consoles as appliances they set up and trust, not as internet facing servers that require the same scrutiny as anything else.

“Attackers see it the other way,” he said. These devices are exposed by design, highly privileged, and rarely instrumented with the endpoint telemetry that is demanded on, say, a Windows server. “That combination makes them some of the most attractive targets in the enterprise,” Beardslee said. Path traversal, the class behind CVE-2026-93616, is one of the oldest web bugs around.

“Seeing it pre-auth on a management service in 2026 is a reminder that simple hacks are sometimes the best hacks,” he noted.

Dickson agreed that the device whose job is keeping attackers out is also, by definition, exposed to the internet and trusted by everything behind it. This “makes it the single most valuable target on the network.”

Ultimately, he pointed to the speed of today’s security landscape: Check Point patched CVE-2026-85102 on September 9, and attackers were exploiting the flaw by September 12.

“Three days is now a normal window for attackers to reverse-engineer a patch into a working exploit,” he said. This, he noted, means that “we’ll patch it during the next maintenance cycle” is no longer an acceptable timeline for anything sitting on the perimeter.

But this isn’t an isolated occurrence, and the common thread isn’t any one vendor’s code quality. F5 access policy manager zero-days were under active attack in the same week as they were revealed, and both companies’ vulnerabilities landed on the KVE catalog on the same day. Perimeter security appliances, firewalls, VPN gateways, and management consoles are a preferred first target for serious attackers precisely because they were built to be trusted, not because they were built carelessly.

“Edge security appliances are simultaneously the most trusted and the most exposed thing on a network,” he said. “That combination is exactly what makes them worth an attacker’s time.”

Advice for enterprises

Check Point advises customers to review logs for anomalous certificate-based Mobile Access logins and second-stage activity, such as internal port or device scans, from suspicious logged-in users.

Dickson goes a step further, urging enterprises to get management off the public internet altogether if possible. “A pre-auth path traversal is only remotely exploitable if the management console is reachable to begin with,” he pointed out.

Also, “hunt, don’t just patch,” he said. Search now for patterns identified by Check Point, rather than assuming a patched system was never touched. Treat the management plane’s blast radius as a design question, not an afterthought. “If one console manages fifty gateways, its compromise is fifty times worse than any one gateway’s, and that ratio is worth revisiting,” Dickson said.

Further, give perimeter and security infrastructure its own patch service level agreement (SLA) measured in days, separate from that of the general IT patch cycle that measures in weeks. Keep an eye on the Known Exploited Vulnerabilities (KVE) catalog as an operational signal rather than as a compliance checkbox.

“Landing on it, as both of these did on September 23, is a strong sign the exploitation is real and ongoing,” Dickson said.

Beardslee emphasized that any code running pre-auth should be “treated as hostile territory.” Keep it minimal, parse in memory safe code where possible, and fuzz relentlessly, he advised. Don’t assume automatic patching covers you; verify versions and hotfix takes on every management server by hand.

Also, be aware that IP blocklists won’t save you here. Attempts originate from anonymization infrastructure, including VPN services and proxies. “The indicators rotate. Behavior doesn’t,” Beardslee said.

Security management web interfaces have no business being reachable from the internet, he noted. Put them behind allowlists or a dedicated admin network, and a pre-auth bug becomes far harder to reach. In the case of VPN gateways that must face the internet, the focus should shift to visibility.

Also, admins should retire end-of-support versions of software and hunt on behavior, not just the indicators. A certificate login never seen before, followed by scanning from the VPN address pool, is the pattern that matters, he noted. Forward gateway and management logs to a security information and event management (SIEM) platform and actually hunt within them. Check Point has published certificate subjects seen in the attacks, but also warned that the list is not exhaustive.

“Hunt backward for signs of compromise, because patching closes the door, but doesn’t evict anyone already inside, taking their time hacking through your infrastructure,” Beardslee said.