DEV Community

StarkMan
StarkMan

Posted on

Check Point CVE-2026-85102 and CVE-2026-93616: Two Flaws, One Gateway, One Deadline

#checkpoint #certificatevalidation #pathtraversal #securitygateway

Check Point CVE-2026-85102 and CVE-2026-93616: Two Flaws, One Gateway, One Deadline

The entries

CISA added two Check Point vulnerabilities to the Known Exploited Vulnerabilities catalog on 2026-09-22, both with a federal remediation deadline of 2026-09-25. CVE-2026-85102 is listed as an improper certificate validation vulnerability across multiple products. CVE-2026-93616 is listed as a path traversal across multiple products. Each has its own NVD record with its own score and affected range, and the vendor advisory assigns fixed builds per product branch.
The two share a product family and a deadline. They do not share a mechanism, and treating them as one fix is the mistake worth avoiding.

Certificate validation and path traversal are different failure modes

Improper certificate validation means the code that decides whether to trust a peer certificate accepts something it should reject. On a security gateway, the consequences land in the places certificates are used: the management interface, site-to-site tunnels, remote access clients and any integration that authenticates with a certificate instead of a password. The attacker's opportunity is to be treated as a trusted peer.
Path traversal is a file access failure. The attacker supplies a path that resolves outside the intended directory, and the result is reading or writing where the application did not intend. On an appliance that stores configuration, logs and keys on its filesystem, a traversal is a route to secrets rather than to a directory listing.
Both flaws sit on a device whose entire purpose is to be the trust boundary. Neither is a remote code execution primitive on its own, which is why the pair deserves to be read together rather than ranked separately.

What the combined remediation looks like

Identify which products and branches in the estate are affected, since the KEV entry names the vendor with multiple products rather than a single appliance model. Management servers, gateways and endpoint clients are separate builds with separate fixes.
Apply the fixes in an order that reflects exposure. Management interfaces reachable from the internet come first, then remote access gateways, then internal components and clients. Where the management interface cannot be patched immediately, move it behind an access broker or a management network.
Then verify trust material. Certificate validation flaws mean that trust decisions made during the exposure window deserve re-examination: review the peer certificates the gateway has accepted, look for certificates issued by unexpected authorities in the trust store, and check the gateway configuration for new or modified trust settings.

Detection that fits these two flaw types

For the certificate issue, the useful signals are connection attempts that were accepted with certificate material that does not match the expected issuer or subject, and configuration changes to trust settings or certificate stores. For the path traversal, look for file access patterns that reference parent directories in request paths, and for new files in locations the appliance does not normally write to.
Log retention matters here. Both flaw types produce evidence in the appliance's own logs, and both allow an attacker with enough access to influence what those logs contain. Shipping logs to a system the gateway does not control is the control that keeps the record intact.

Reading a two-CVE day

Vendors occasionally publish several fixes at once, and CISA occasionally lists more than one on the same day. Consolidating is efficient and occasionally wrong. Two flaws with different mechanisms require two verification steps, and a gateway that has been patched against one of them is not patched.

References

Top comments (0)