CVE-2026-85102, CVE-2026-93616: Check Point Security Gateway — Remote Code Execution Risk (July 2026)

CVE-2026-85102, CVE-2026-93616 — Check Point Security Gateway

Two critical vulnerabilities, CVE-2026-85102 and CVE-2026-93616, allow unauthenticated attackers to achieve remote code execution on Check Point Security Gateway and Security Management products. Both CVEs are actively exploited in the wild, with a critical severity rating and a two-month exposure window before patches became available in September 2026.

Attack Vector

Attackers remotely exploited these zero-days to bypass authentication and execute arbitrary code on targeted Check Point perimeter devices. The vulnerabilities require only network access to the management or gateway interface—no credentials or user interaction are needed. Successful exploitation grants attackers privileged access, enabling full control over firewall gateways, modification of security rules, lateral movement, and exfiltration of sensitive configuration data. The attacks began on July 23, 2026, and targeted enterprise perimeter defenses globally.

Who Is at Risk

All organizations running Check Point Security Gateway and Security Management products are at risk, especially those with exposed management interfaces. Enterprises with perimeter deployments or cloud-based Check Point appliances are particularly vulnerable. Confirmed exploitation has occurred in multiple global organizations relying on Check Point for network defense.

Patch & Mitigate

• Patch: Apply the official Check Point security updates released in September 2026 for all affected Security Gateway and Security Management versions. Prioritize internet-exposed systems.
• Workaround: Restrict access to management interfaces from untrusted networks and implement network segmentation until patches are applied.
• Detect: Review logs for unauthorized access attempts, unexpected configuration changes, and anomalous outbound connections from gateway appliances since July 23, 2026.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploited exposed interfaces to gain a foothold on security infrastructure.
• TA0005 — Defense Evasion: Exploitation allowed attackers to manipulate firewall rules and evade detection.
• TA0007 — Discovery: Attackers mapped internal networks and harvested configuration data post-compromise.

Source: https://www.csoonline.com/article/4225812/check-point-hacked-the-security-software-protecting-your-network-has-become-a-prime-attack-target.html