Check Point published details of the issue and a fix on September 9, 2026. The company said there was no evidence of exploitation at the time of the patch release, but it has since detected attacks targeting Check Point Spark customers.
The attacks, which first appeared on September 12, originate from anonymization infrastructure including VPN offerings and proxies. The researchers noted several certificates with subjects including “CN=vpn,OU=users,O=global,” “CN=vpn-user,OU=users,O=global” and “CN=vpnuser,OU=users,O=global.”
Check Point warned that the list of certificate subjects is not comprehensive.
Customers were advised to review logs for anomalous certificate-based Mobile Access logins and not limit search terms to the certificate subjects included in the advisory.
They should also look out for any suspicious activity from users that have authenticated to the gateway via Mobile Access including scanning of internal ports and services.
The second issue, CVE-2026-93616, is a pre-authentication path traversal vulnerability in the management web service of Check Point Security Management.
An attacker could cause the system to execute a script from an arbitrary path and read an arbitrary Java class file, enabling them to gain unauthorized access to the underlying system.
Check Point reported several limited attacks using this flaw on July 23, 2026. A patch for CVE-2026-93616 has been released, and customers are being urged to apply it immediately.
Affected versions of Check Point Security Management include R82.20, R82.10 Jumbo Hotfix Take 44 or lower, R82 Jumbo Hotfix Take 126 or lower, R81.20 Jumbo Hotfix Take 166 or lower and R81.10 Jumbo Hotfix Take 190 or lower.
LivePatch Take 28/29 does not mitigate the vulnerability. End-of-life versions of the product are also affected.
Check Point recommended that all customers with affected versions of the product should apply the relevant hotfix as both flaws are currently being actively exploited.
