Check Point Pre-Auth Flaws Under Attack

Check Point disclosed two critical pre-authentication vulnerabilities—CVE-2026-85102 (improper certificate validation in VPN negotiation enabling RCE on Security Gateways/Spark Firewalls) and CVE-2026-93616 (pre-auth path traversal in the Management web service allowing arbitrary script/class execution). Both carry CVSS 3.1 scores of 9.8, are confirmed exploited in the wild (including pre-disclosure targeted activity), have been added to CISA’s KEV catalog, and require immediate application of vendor hotfixes and active hunting for indicators such as suspicious certificate subjects, long usernames, unusual core dumps, and traversal-related file paths.