A firewall is designed to shield enterprise networks from threats, yet a recent revelation has shown that such security systems can themselves be targets for attackers. Check Point has disclosed that threat actors are actively targeting two key vulnerabilities within its Security Gateway and Security Management products, specifically CVE-2026-85102 and CVE-2026-93616.
The first vulnerability, CVE-2026-85102, is a remote code execution (RCE) flaw that affects the Check Point Spark small business firewall, which was made public on September 9. Alongside this, a zero-day pre-authentication vulnerability, CVE-2026-93616, was identified in the Security Management web service. Both vulnerabilities have been rated with a CVSS score of 9.8, highlighting their severity as they enable attackers to infiltrate systems without needing usernames or passwords — the worst-case scenario for any firewall provider.
Pre-Authentication Vulnerabilities: An Invitation to Intruders
These vulnerabilities operate at a pre-authentication level, indicating that attackers can bypass normal login processes entirely. Aaron Beardslee, a threat research manager at Securonix, described CVE-2026-85102’s exploitation process during the initial VPN negotiations: the attacker needs only to present a malicious certificate, allowing the gateway to handle the rest. This situation illustrates a profound failure in what should be a multi-layered security approach.
Once an attacker leverages the code execution vulnerability, they can gain a foothold inside the network. "The gateway is the front door, the lock, and the security guard all in one box,” Beardslee pointed out. Essentially, the compromised gateway provides access to the trusted network, enabling attackers to quickly map internal systems.
On the other hand, CVE-2026-93616 permits attackers to execute scripts from arbitrary paths and load Java classes from any location. The potential impact of this vulnerability is profound, as it could allow an attacker to rewrite firewall rules and extract configuration details, effectively giving them control over the entire network architecture. The irony here is that while firewalls are designed to prevent intrusions, these vulnerabilities offer a 'skeleton key' to attackers.
The Security Software Challenge
These findings underscore a broader issue: security products, which are intended to protect organizations, are not immune to flaws. Beardslee remarked, “Security products are software, and software has bugs.” Organizations often mistakenly treat firewalls and their management interfaces as appliances that need little to no scrutiny, failing to appreciate that these systems are exposed and thus vulnerable.
The combination of being highly privileged and inadequately monitored makes firewalls attractive targets for sophisticated attackers. Beardslee noted that the pathway traversal vulnerability inherent in CVE-2026-93616 is a reminder that many successful hacks rely on rather simple exploit techniques.
Furthermore, the speed with which these vulnerabilities were discovered and exploited is concerning. Check Point patched CVE-2026-85102 on September 9, and attackers started exploiting it by September 12, indicating a mere three-day window for adversaries to develop exploit capabilities. Frank Dickson, an analyst at Dickson Research, emphasized that the normalization of such rapid exploitation signifies businesses can no longer afford to delay patching security vulnerabilities, particularly for perimeter devices.
Recommendations for Organizations
In response to these critical issues, Check Point has urged its customers to examine their logs for unusual mobile access logins and to remain vigilant about any suspicious activity following logins. Dickson advises enterprises to consider removing management interfaces from the public internet altogether to mitigate exposure to such vulnerabilities.
Beyond mere patching, organizations should adopt a more proactive stance in their security strategies. Dickson recommends searching for patterns indicative of breaches rather than assuming a system is untouched simply due to successful patching. The management server's importance cannot be understated; if compromised, it poses a risk far greater than one isolated gateway.
The need for rapid patch response times specifically for perimeter security products is underscored by the inherent risks they carry. As such, implementing a dedicated service level agreement (SLA) for these critical components should be prioritized, ensuring they receive faster attention than standard IT infrastructure.
Moreover, Beardslee advises treating any code running before authentication as potentially hostile territory. Keeping such code to a minimum, using memory-safe programming techniques, and adopting extensive fuzz testing are critical practices for maintaining security integrity. Furthermore, relying solely on IP blocklists may not suffice, as attackers often utilize anonymization services to mask their activities.
Finally, Beardslee stressed that security management interfaces should not be directly accessible from the internet. Isolating them on a dedicated admin network or enforcing strict allowlisting can significantly reduce the risk posed by pre-authentication vulnerabilities. Monitoring behavioral patterns, rather than just static indicators, is essential for uncovering deeper threats within the network.
In conclusion, while vulnerabilities in systems like Check Point's Security Gateway serve as a stark reminder of the omnipresent risks, they also highlight the pressing need for organizations to revisit their security strategies and ensure they can adapt to the fast-paced threat landscape.
