Saturday's Check Point LivePatch is not the July management-server hole

Saturday we told Check Point shops to confirm LivePatch for CVE-2026-91843. That take does not close today's hole. CVE-2026-93616 is a different bug on the same Security Management Server. Check Point says a handful of targeted attacks used it on July 23. The fix shipped yesterday. Anyone who can reach the management web service can run scripts without a login. They scored it 9.8. This morning we wrote F5 APM if it hands out OAuth tokens. Same class of box: the brain, not the gate. Saturday's LivePatch is not a pass.

What Saturday's take did not cover

91843 was a login-path overflow. LivePatch Take 28 (Take 29 on R82.20), sk1000155. Check Point is explicit that those takes do not fix 93616. The new one is in the management web service. We are not going to walk the request. The useful sentence is theirs: no login, scripts on the server, if you can reach that service.

Affected list from the CVE record: R82.20 with no Jumbo (the advisory also lists R82.20 without that caveat), R82.10 at Jumbo Take 44 or below, R82 at 126 or below, R81.20 at 166 or below, R81.10 at 190 or below (end of support), and the R81 and R80.x tail. September 9's VPN certificate hole (CVE-2026-85103) sat one take lower on some branches. A server that only climbed far enough to leave that range is still in this one.

The fix and the hunt list are in sk1000171. Installing it does not tell you whether July already happened on that box. Check Point did not name the targets or what the operators did after. A handful is not zero.

The Spark VPN attempts are a separate ticket

Since September 12, Check Point has seen tries against CVE-2026-85102, a VPN certificate check they fixed on September 9 (sk1000117). Spark, the small-business line, is in the targeting. Site-to-site and remote access. They have not said a try succeeded. Traffic came through anonymizing paths. They published certificate subjects to hunt: CN=vpn, CN=vpn-user, and CN=vpnuser, each under OU=users, O=global. The list is not complete. Look for odd certificate-based Mobile Access logins, not only those three names, and what those users did next (internal scans are the usual next page). September 9 on the gateway is the close. A Site-to-site workaround (implied VPN rules off, UDP 500 and 4500 only from named peers) does not cover locally managed Spark.

The rest of Wednesday, in one paragraph

Zyxel GS1900 is due tomorrow. F5 APM is due Friday. cPanel CalDAV-to-root and WordPress 7.1.2 are this morning's other two. DepthFirst published a container-to-host test for CVE-2026-80521, a kernel AF_UNIX bug fixed upstream in August. Ubuntu has not shipped it on 26.04, 24.04, or 22.04, including the cloud kernels. No confirmed use. No workaround. Do not fetch the test. If you run untrusted containers on those LTS boxes, that is a isolation conversation until Canonical's kernel lands. ShinyHunters claimed an FBI PeopleSoft breach. Treat it as a claim until the Bureau says otherwise. Microsoft says the same September updates that went quiet on File History can also break Always On VPN on some Windows 11 boxes. Do not uninstall the Stack KB. InfraTrust's note today is the theme: management systems are the product being hit, before or right after the vendor writes it down.

What we would check before Thursday

• Every Security Management Server: write the release and Jumbo take. Then install what sk1000171 names. cplp list still matters for Saturday's 91843. That take is not this take.
• Hunt with the indicators in sk1000171. A clean patch is not a clean history.
• Trusted Clients: named hosts. Management off the internet. That was July and it is still Wednesday.
• Spark and other gateways: confirm the September 9 VPN fix. Hunt the certificate subjects Check Point named, plus any other odd Mobile Access login.
• Flash the GS1900 if you have one. F5 hotfix or iRule if APM issues tokens. Do not roll back September to fix VPN or File History.

Bottom line

A LivePatch from Saturday does not close a July attack that they disclosed on Tuesday. Forensic Five reviews the box that writes firewall policy, not only the box that passes traffic. From St. Albert, Alberta. Read sk1000171. Then go finish the switch before tomorrow's clock.