Check Point discloses exploitation of gateway and management flaws

Check Point’s September 22 advisory reports attacks against two separate security products. VPN certificate handling in Security Gateway permits unauthenticated code execution; a Security Management flaw enables arbitrary-path script execution. Gateway fixes arrived September 9, while the management fix accompanied this advisory.

Brief updated 25 Sep 2026, 02:25 UTC · AI-written

The vendor dates observed Spark exploitation attempts to September 12. Separately, it reports a handful of targeted management attacks on July 23; this week’s disclosure does not mean those attacks began this week.

The management issue, CVE-2026-93616, also permits loading arbitrary Java classes. Check Point explicitly says LivePatch Takes 28 and 29 do not address it, so protection against the gateway issue cannot establish management coverage.

What remains unclear

Exploitation findings are vendor-reported; the gateway support article could not be opened during this check.