22OCT

Two 9.8 Check Point flaws hit firewalls

2 min read

16:31UTC

CISA listed two Check Point flaws scoring 9.8 on 22 September, one in VPN negotiation on Spark firewalls and one on management servers.

← Back to Fridge hack spoils food in seven countries Jump to analysis ↓

TechnologyAssessed

Key takeaway

Check Point's two September flaws need separate gateway and management updates to close.

Check Point had two flaws scoring 9.8 on the Common Vulnerability Scoring System (CVSS) put on the US federal exploited-flaw catalogue on 22 September, with a 25 September deadline⁠¹. CVE-2026-85102 lets an attacker with no login run code on a Security Gateway or Spark firewall through certificate data sent while a virtual private network (VPN) connection is negotiated. Check Point says it was exploited on Spark firewalls from 12 September⁠². That makes it the company's second exploited VPN flaw of 2026, after June's authentication bypass in its Remote Access VPN; a SmartConsole login flaw was also listed in July.

The second, CVE-2026-93616, gives script execution on Check Point management and log servers over Transmission Control Protocol (TCP) port 19009. The vendor says it was used against a "handful of customers"⁠³.

The R81.20 gateway fix is Take 166 and the management fix is Take 170. A site that patched its gateways for the VPN flaw in mid-September still had its management server open until it took the second update.

Deep Analysis

In plain English

Check Point is an Israeli company that makes firewalls, the devices that guard the boundary between a company's network and the internet. Many also let staff connect from home through a virtual private network (VPN). Two flaws were found. One lets an attacker take over the firewall by sending booby-trapped data while setting up a VPN connection. The other lets an attacker take over the separate server that controls all of a company's firewall rules. The US Cybersecurity and Infrastructure Security Agency (CISA) confirmed both were being used in attacks and gave government departments three days to fix them.

Deep Analysis

Root Causes

Spark firewalls are sold to branch offices and small businesses, where Remote Access VPN with certificate authentication is often switched on and left at defaults. Gateways in DAIP or Large Scale VPN communities enable the vulnerable code path automatically, so many owners had exposure they never chose.

Management and log servers are frequently run by outsourced security providers who need to reach them remotely. Port 19009 open to the internet is a convenience for those providers that turns one flaw into control of every firewall policy the server manages.

Check Point releases fixes as numbered Jumbo Takes per branch, and the gateway fix (R81.20 Take 166) sits below the management fix (Take 170).

What could happen next?

Risk
A compromised management server lets attackers rewrite firewall policy across every gateway it controls, so one exposed server can open many networks.
Opportunity
Check Point gains an argument for moving customers to hosted management, which it fixed before telling anyone.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: In May 2024 Check Point disclosed CVE-2024-24919, a Quantum Gateway flaw that let attackers read files including password hashes; incident responders at mnemonic traced exploitation back to 30 April. Check Point first framed it as attacks on old local accounts, before a code flaw was confirmed.

Counter-parallel: In October 2024 Fortinet's FortiManager flaw CVE-2024-47575 let attackers steal configurations from more than 50 central management servers, according to Mandiant. Fortinet warned customers privately before its public advisory, the reverse of the same-day public listing CISA gave Check Point.

No LivePatch exists or is planned for the management flaw, so every affected management server needs a full Jumbo installation and restart. For providers running Multi-Domain Management across many clients, that means a coordinated outage of policy pushes.

Check Point's quarterly results will show whether customers respond by moving management to Smart-1 Cloud, the hosted service that was fixed before disclosure.

Consensus view: Check Point's own articles sk1000117 and sk1000171 show two separate attack surfaces hit in the same fortnight: the gateway through VPN certificate handling, and the management and log plane through TCP port 19009. Its workarounds, explicit rules for UDP 500 and 4500 from known peers and restricting port 19009 to trusted addresses, confirm both were exposed by default configuration rather than exotic set-ups.

Counter-view: Check Point, headquartered in Tel Aviv, describes the management-server flaw as exploited against a 'handful of customers' and says Smart-1 Cloud was already fixed, implying limited reach. CISA nonetheless gave it the same three-day clock as the gateway flaw, judging exposure by what an attacker gains from a management server rather than by observed victim counts.

Key tension: How many Check Point management servers are reachable from the internet on port 19009, which no vendor or government figure has yet answered.

Sources:CISA·Check Point·Check Point

Mentions:Check Point →CISA →Known Exploited Vulnerabilities →Fortinet →Mandiant →Common Vulnerability Scoring System →Tel Aviv →CVE-2026-85102 →CVE-2026-93616 →SmartConsole →FortiManager →

First Reported In

Update #14 · China alert puts old bugs on a 3-day clock

CISA· 12 Oct 2026

Read original →

Causes and effects

Caused by

VPN zero-day open a month pre-patch

Check Point's June VPN zero-day preceded a second exploited VPN flaw in September.

Occurred 8 Jun 2026

Read story →

This Event

Two 9.8 Check Point flaws hit firewalls

The gateway and the console that manages it needed separate updates, so one patch round left a site half fixed.

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.