Check Point warns of a management server zero-day used in targeted attacks

Check Point has warned that a previously unknown flaw in its Security Management Server was exploited in a handful of targeted attacks. According to the vendor, the incidents took place back on July 23, yet a fix only arrived on September 22.

The flaw in the management server

The vulnerability is tracked as CVE-2026-93616. It is a path traversal bug in the management server's web service: the service does not properly limit which files and folders a request can reach. As a result, an attacker able to reach the web service can upload scripts to the server and then run them — all without logging in. On the CVSS scale the flaw is rated 9.8 out of 10.

The server in question controls the firewall policies for the Check Point gateways it manages. In its advisory the company names neither the targets of the July attacks nor those behind them, and it does not say what the intruders did once inside.

The list of affected versions spans a range of releases — from R82.20 with no Jumbo Hotfix installed down to the long-unsupported R80.x builds. Administrators are asked to check their server's release and hotfix level against that list, install the fix from support article sk1000171, and use the hunting guidance provided there. One point is stressed: installing the update will not reveal whether the server had already been compromised.

Spark firewalls under fire

Separately, Check Point reported attempts to exploit another flaw, CVE-2026-85102, which it had already patched on September 9. The attempts began on September 12 and target customers of Spark, its firewall line for small businesses. When the fix shipped, there was no evidence of exploitation.

The bug lies in the way gateways check certificates while a VPN connection is being set up, and it may let an unauthenticated attacker run code on the gateway. According to the company, the attempts came from anonymizing infrastructure — VPN services and proxies — and used certificates with telltale subjects such as CN=vpn or CN=vpnuser. The list is not exhaustive, so administrators are advised to check logs for any unusual certificate-based logins and to watch what suspicious Mobile Access users do afterward, which often includes scanning internal ports and services.

For gateways that cannot yet be patched, a temporary measure is offered: turn off the implied VPN rules and allow UDP ports 500 and 4500 only from specific trusted addresses. The workaround does not apply to locally managed Spark firewalls. Details are in support article sk1000117.

Source: The Hacker News