Act today Critical Known exploited Patch available CVSS up to 9.8 (NVD)
Check Point releases emergency fixes for gateway flaw already exploited
BleepingComputerCheck PointCVE-2026-123039, CVE-2026-93616, CVE-2026-85102
What happened. BleepingComputer reports Check Point has released emergency hotfixes for a high-severity flaw. Attackers have exploited it since late October to gain root privileges and set up persistence on vulnerable devices.
Who is affected. Organisations running vulnerable Check Point gateways. Industrial sites using such gateways for remote access are exposed, because vendors and engineers often reach plant systems through them. The source names no versions.
What to do. Apply the Check Point emergency hotfixes to your gateways. Check them for signs of compromise, as exploitation began in late October.
When to act. Act today: Operators running Check Point gateways: hotfixes exist and exploitation is ongoing; patch today.
Editor's reading
Forasset ownerdetection engineerIT security
- Purdue level
- L5
- L3.5
Why: A VPN and security gateway is a perimeter and remote-access product, so it sits in the industrial DMZ (L3.5) or at the internet-facing edge (L5).
- Are you exposed?
Check your inventory for Check Point gateways, confirm whether the hotfix is installed, and review gateway logs back to late October.
- If you cannot fix it yet
- Limit who can connect through the gateway to named users and known source addresses.
- Require multi-factor authentication on the remote-access path.
- Keep the gateway's management interface off the plant network until the hotfix is applied.
- Watch for
- Unexpected root-level logons or new persistent accounts and processes on Check Point gateways since late October.
- Remote-access sessions through the gateway that reach plant systems at unusual times or from unfamiliar sources.
- ATT&CK for ICS
- T0866Exploitation of Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: BleepingComputer (opens bleepingcomputer.com)
Vendor advisory: support.checkpoint.com
More on Check Point CVE-2026-123039 CVE-2026-85102 CVE-2026-93616