CISA KEV Adds Check Point’s Twin CVSS 9.8 Flaws — Due September 25

TL;DR: CISA added two CVSS 9.8 Check Point vulnerabilities to its KEV catalog on September 22 with a three-day remediation deadline. CVE-2026-85102 is an unauthenticated RCE in Security Gateway’s VPN certificate validation, actively exploited since September 12. CVE-2026-93616 is a pre-authentication path traversal in the Management web service with zero-day exploitation since July 23. Both ship a single upgrade path.

The Batch

On September 22, CISA added four new KEV entries, but two are tightly coupled — both in the Check Point Security Gateway and Management stack, both CVSS 9.8, both in CISA’s Security Advisory sk1000117 / sk1000171:

  • CVE-2026-85102 — Improper certificate validation during IKEv2 VPN negotiation → unauthenticated RCE (CWE-295)
  • CVE-2026-93616 — Pre-authentication directory traversal + file upload in the Management web service → arbitrary script execution + arbitrary Java class load (CWE-22)

CISA’s KEV entries carry a due date of September 25, 2026 — the shortest practical window for organizations that need to schedule a production change. Both are marked forensic-triage-required.

CVE-2026-85102: The One That’s Already Moving

CVE-2026-85102 was disclosed on September 7, 2026 with fixes available September 9. For over a week Check Point said “no exploitation.” Then on September 12, a wave of exploitation attempts hit Spark (Cloud-Managed) customers through anonymizing infrastructure. Check Point’s September 22 advisory confirmed active exploitation.

The attack surface is specific: the vulnerability lives in the IKEv2 certificate validation path, which means it only triggers when Site-to-Site VPN or Remote Access VPN is in use. Check Point observed these certificate subjects in the wild:

CN=vpn,OU=users,O=global
CN=vpn-user,OU=users,O=global
CN=vpnuser,OU=users,O=global

But the list is non-exhaustive. Post-exploitation behavior includes anomalous certificate-based Mobile Access logins followed by second-stage internal port scanning from the compromised user context.

Affected versions: R81 (EoS), R81.10 (EoS), R81.10.X, R81.20, R82, R82.00.X, R82.10. Fix in the latest Jumbo Hotfix Take and LivePatch.

Key detail: LivePatch Takes 28/29 do not address CVE-2026-85102. Take 30+ is required.

CVE-2026-93616: The Zero-Day That Sneaked In

CVE-2026-93616 is the more interesting case from a timeline perspective. Check Point Research spotted the first exploitation attempts on July 23, 2026 — three months before the September 22 advisory. The flaw lives in the Management web service’s directory traversal handling, allowing an unauthenticated attacker to upload and execute arbitrary scripts, plus load arbitrary Java classes on the management server.

Smart-1 Cloud and Check Point Firewall / Spark appliances are not affected by 93616. Only on-prem Security Management Server, Multi-Domain Security Management, Log Server, Multi-Domain Log Server, and SmartEvent are in scope.

Affected versions: Same as 85102. Fix in the same Jumbo Hotfix Take.

Key detail: LivePatch Take 28/29 does not address 93616 either. The vendor explicitly calls this out.

Why This Batch Matters

Three reasons:

  1. The zero-day gap. CVE-2026-93616 was exploited from July 23 with no advisory until September 22. That’s 61 days of undetected pre-auth traversal on Management servers. If you’re running on-prem Check Point Management, the question isn’t whether it was hit — it’s what it hit.

  2. The exploitation confirmation lag. CVE-2026-85102 sat unexploited for 10 days after disclosure, then suddenly had a wave of Spark-targeted probes. The 22nd advisory is an update, not the initial disclosure. This pattern — “no exploitation” followed by confirmed waves — is becoming the new normal for vendor advisories.

  3. The three-day deadline. CISA’s BOD 26-04 applies the shortest remediation tier (three days + forensic triage) to internet-facing, actively exploited vulnerabilities with unpatchable remote access paths. Both Check Point flaws hit that cell: gateway-facing, certificate-based auth, remote code execution.

What to Check

For CVE-2026-85102:

  • Confirm which Check Point version line you’re running
  • If on R81.x or R82.x, check whether the latest Jumbo Hotfix Take is installed
  • If using Spark (Cloud-Managed), verify LivePatch Take 30+ is active
  • Search Mobile Access logs for the certificate subjects above and second-stage port scans from those users

For CVE-2026-93616:

  • Confirm you’re running on-prem Management Server (Smart-1 Cloud is excluded)
  • Verify TCP/19009 is only reachable from trusted IPs
  • Check Trusted Clients restrictions in SmartConsole
  • Hunt for arbitrary script execution or Java class load in management audit logs

Both:

  • Upgrade to the latest Jumbo Hotfix Take (not just any Take — check the release notes for both CVEs)
  • Complete forensic triage on affected systems per BOD 26-04 requirements

The Takeaway

When a vendor says “no exploitation” for ten days and then adds “action required — active exploitation” in the next advisory, your patch window shrinks from “schedule it next month” to “emergency change Tuesday.” Check Point’s September 22 advisory is a case study in why the gap between “fix available” and “CISA KEV” isn’t just bureaucratic noise — it’s the window where exploitation matures from theoretical to confirmed.

Sources