Check Point Multiple Products Vulnerabilities Added to CISA KEV

What's on the official record

CISA added two Check Point vulnerabilities to the Known Exploited Vulnerabilities Catalog, both with dateAdded 2026-09-22, dueDate 2026-09-25, and catalogVersion 2026.10.21.

CVE-2026-85102 is an improper certificate validation vulnerability in Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN, which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway (CWE-295). The record names no fixed version; it points to a vendor advisory. FIRST's EPSS model estimates a 0.542 probability of exploitation (p99, 2026-10-23). CISA's ADP assesses exploitation active, automatable yes, impact total. The catalog does not record known ransomware use.

CVE-2026-93616 is a path traversal vulnerability in Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent that allows an unauthenticated attacker to upload and execute arbitrary scripts (CWE-22). The record names no fixed version; it points to a vendor advisory. FIRST's EPSS model estimates a 0.759 probability of exploitation (p100, 2026-10-23). CISA's ADP assesses exploitation active, automatable yes, impact total. The catalog does not record known ransomware use.

Assessment

For a platform or AI-stack owner, the record lets you check whether any Check Point Security Gateway, Spark Firewall, Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, or SmartEvent in your estate is running a version covered by either CVE, and whether the vendor advisory's mitigations have been applied. The catalog names no fixed version, so the decision is to follow the vendor advisory and isolate or patch affected appliances rather than assume a version is safe.

For a cyber underwriter, the record lets you check whether a policyholder's Check Point VPN or management estate is in scope for either CVE and whether the vendor advisory's mitigations are in place. CISA's ADP assesses both as actively exploited and automatable with total impact, which bears on pricing and on requiring a control before binding or renewal.

What would change this call

A vendor advisory naming a fixed version for either CVE would change the remediation guidance from "follow the advisory" to "upgrade to a specific version." A CISA update to the catalog's dueDate or catalogVersion would change the compliance clock for federal civilian agencies.

What to check next

Confidence

Filed 23 October 2026 from the record dated 22 September 2026. The record is CISA's Known Exploited Vulnerabilities Catalog, a primary source; the fixed-version status is unresolved because both rows point to vendor advisories rather than naming a version.

Sources

[1] Check Point Multiple Products Improper Certificate Validation Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-85102

[2] CVE record CVE-2026-85102 — https://www.cve.org/CVERecord?id=CVE-2026-85102

[3] Check Point Multiple Products Path Traversal Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-93616

[4] CVE record CVE-2026-93616 — https://www.cve.org/CVERecord?id=CVE-2026-93616

[5] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog