Cybersecurity
Check Point patches exploited management server flaw
Check Point said attackers used a management server flaw in July and reported later attempts against a separate VPN issue that it had already patched in September.
- Check Point said attackers exploited CVE-2026-93616 in its Security Management Server on 23 July.
- The company said the flaw let an attacker who could reach the server's web service upload scripts and run them without logging in.
- Check Point released a fix for that server on 22 September.
- It also said attempts had been made since 12 September to exploit CVE-2026-85102, a VPN certificate flaw fixed on 9 September.
- Check Point said the VPN attempts used anonymising infrastructure and certificates with listed subjects, and the flaw affected Security Gateway and Spark firewalls.
Check Point said attackers used CVE-2026-93616 against its Security Management Server on 23 July. The company said the flaw let an attacker who could reach the web service upload scripts and run them without logging in.
Check Point released a fix for that server on 22 September. Its advisory did not name the targets or the attackers, and it did not say what happened after the server was accessed.
The company also said it had seen attempts since 12 September to exploit CVE-2026-85102, a VPN certificate flaw it fixed on 9 September. Check Point said the attempts came through anonymising infrastructure and used certificates with several listed subjects.
The VPN flaw affected Security Gateway and Spark firewalls on the releases Check Point listed, and the Netherlands' National Cyber Security Centre said it applied when those products used Site-to-Site VPN or Remote Access VPN. Check Point said customers who installed the 9 September fix were protected, but it did not say whether any attempt succeeded.
Named in this story
Companies
- Check Point
- said attackers exploited the flaws and released fixes
Governments and agencies
- France's CERT Santé
- summarised Check Point's advisory on LivePatch take numbers
- The Netherlands' National Cyber Security Centre (NCSC)
- said when the VPN flaw applied and listed a workaround
Products and systems
- Security Management Server
- was the server with the disclosed web-service flaw
- Security Gateway
- was one of the products affected by the VPN certificate flaw
- Spark firewalls
- were targeted through the VPN flaw
- LivePatch
- was Check Point's urgent-fix channel
How the source tells it
The piece read as a technical advisory: neutral, procedural and largely free of emotive framing.
No emotive framing was found in the original.