Check Point Warns of VPN Zero-Day Flaws Exploited in Attacks

Executive Summary

Check Point Software Technologies has issued an urgent security warning confirming active in-the-wild exploitation of two critical pre-authentication vulnerabilities affecting its Security Gateway and Quantum Spark product families. The primary vulnerability, tracked as CVE-2026-85102, allows unauthenticated remote attackers to execute arbitrary code with root privileges on target perimeter devices by weaponizing a flaw in the gateway's VPN certificate-handling functionality.

Concurrently, Check Point warned of active exploitation targeting CVE-2026-93616, a pre-authentication directory traversal vulnerability within the gateway's Management Web Service. Telemetry confirms that CVE-2026-93616 has been weaponized by sophisticated threat actors as a zero-day since July 23, 2026, enabling arbitrary script execution and the loading of malicious Java classes.

The United States Cybersecurity and Infrastructure Security Agency (CISA) has added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating emergency remediation across federal agencies. Threat telemetry indicates exploitation attempts initiated on September 12, primarily targeting Quantum Spark firewall appliances deployed across commercial enterprise perimeters.

Technical Vulnerability Analysis & Attack Chain

The attack chain involves low-complexity perimeter ingress via network services exposed directly to the public Internet:

1. Automated Perimeter Scanning via Anonymized Relays: Beginning September 12, threat actors deployed automated scanning nodes through commercial VPN services and residential proxy relays to locate exposed Check Point Security Gateways listening on IPsec and SSL VPN ports (UDP 500, UDP 4500, TCP 443).
2. Rogue Certificate Handshake Ingress (CVE-2026-85102): The attacker initiates an unauthenticated VPN tunnel negotiation, submitting a crafted client certificate. The gateway's certificate validation parser improperly processes malformed attributes, triggering memory corruption that allows arbitrary shellcode execution in the context of the underlying operating system daemon.
3. Management Service Path Traversal (CVE-2026-93616): Alternatively, attackers exploit path traversal sequences within the Management Web Service interface. This bypasses authentication filters, permitting arbitrary file reads, unauthorized server-side script execution, and dynamic Java class loading.
4. Host Takeover & OS Persistence: Upon achieving root-level code execution on the underlying Gaia OS platform, attackers disable security audit logs, establish persistent command-and-control backdoors, and extract local cryptographic secrets, including site-to-site VPN pre-shared keys (PSKs) and administrator hashes.
5. Perimeter-to-Core Pivoting: Utilizing the compromised firewall as an unmonitored ingress bridge, the adversary moves laterally into internal corporate VLANs, circumventing perimeter firewall inspection and initiating deep domain discovery.

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Campaign Attribution

Attacks observed in the wild originate from heavily anonymized infrastructure, indicating high operational security. Check Point noted that all observed exploitation waves utilized commercial VPN exit nodes and residential proxy services to obscure geographic origin.

Targeting heavily centers on Quantum Spark appliances utilized by distributed branch offices, retail chains, and mid-sized enterprises. The early zero-day exploitation of CVE-2026-93616 dating back to July 23 points to advanced persistent threat (APT) groups or specialized initial access brokers (IABs) who routinely stockpile edge appliance zero-days to breach high-value corporate perimeters.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Install LivePatch Take 26: Check Point has issued LivePatch Take 26 for supported R81.20, R82, and R82.10 gateways. Security teams must verify active installation by executing cpinfo -y CPupdates on the Security Gateway in expert mode. Check Point warns that earlier offline LivePatch packages do not provide full coverage.
• Apply Jumbo Hotfix Accumulator: For systems not utilizing LivePatch, upgrade immediately to the fixed Jumbo Hotfix releases: R81.20 Take 166, R82 Take 126, R82.10 Take 44, or R81.10 Take 190.
• Quantum Spark Firmware: Update Quantum Spark hardware to firmware versions R82.00.10 Build 2325 or R81.10.17 Build 4968 or higher.

2. Network & Perimeter Defenses

• Disable VPN Implied Rules: Where patching cannot be completed immediately, disable VPN implied rules and replace them with explicit firewall rules restricting Site-to-Site VPN access on UDP 500 and UDP 4500 exclusively to verified external peer IP addresses.
• Restrict Remote Access Ingress: For Remote Access VPN services, restrict source IP address ranges to known geographic regions or trusted enterprise client blocks where possible.
• Isolate Management Portals: Ensure Check Point management web service interfaces (TCP 443 / 80) are never accessible from the public Internet; restrict access strictly to internal out-of-band management subnets.

3. Endpoint Detection & Hunting Query

title: Suspicious Process Spawning or Malicious Certificate Subject on Check Point Gaia OS
id: 8f2c4e19-5a3d-4b78-9012-789012abcdef
status: experimental
description: Detects suspicious child process creation from Check Point VPN daemons (vpnd, cvpn) or certificate handshakes containing known malicious subjects.
author: CyberNewsAI Threat Intelligence
references:
  - https://www.bleepingcomputer.com/news/security/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw/
tags:
  - attack.t1190
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/vpnd'
      - '/cvpnd'
      - '/cpd'
      - '/Httpd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/python'
      - '/curl'
      - '/wget'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate automated maintenance scripts executed by Check Point administrative daemons
level: critical

// Microsoft Sentinel / Defender Hunting Query: Detect Anomalous Edge Gateway Activity and Rogue Certificate Logons
CommonSecurityLog
| where DeviceVendor =~ "Check Point"
| where TimeGenerated > ago(7d)
| where Message has_any (
    "CN=vpn,OU=users,O=global",
    "CN=vpn-user,OU=users,O=global",
    "CN=vpnuser,OU=users,O=global",
    "CVE-2026-85102",
    "CVE-2026-93616"
) or (Activity =~ "VPN Certificate Validation Failed" and SourceIP !in~ ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"))
| project TimeGenerated, DeviceName, SourceIP, DestinationIP, Activity, Message, Protocol
| sort by TimeGenerated desc

Malicious Certificate Subjects

Targeted Appliances & Vulnerability Matrix