Attackers Sat Inside Check Point's Firewall Brain for Two Months. The Stock Went Up.

The grep that tells you July happened

Somewhere this week an administrator is running a one-line grep over the logs of the machine that writes firewall policy for the entire company. Check Point's advisory asks for it: the search for oversized login names↗ is how a shop learns whether CVE-2026-93616, a pre-authentication path traversal rated 9.8 out of 10, let a stranger run scripts on the Management Server without a password ¹. "You don't need to break the firewall when you can tell it what to allow," says Aaron Beardslee, manager of threat research at Securonix↗ ².

Attackers held that ground from 23 July until the fix landed on 22 September↗ ¹³. The same week, the stock crossed its 200-day average↗ ⁴.

Two months of quiet, then three days of law

CISA put both Check Point flaws, each rated 9.8, into one Known Exploited Vulnerabilities batch on 22 September, giving federal agencies until the 25th under BOD 26-04↗ ³⁵. The vendor's quiet window ran two months ¹; the government's remediation window ran three days ³⁵.

The fix does not reach everyone. Every legacy R80 and R81 release is affected and out of support, so the only remediation is an upgrade, not a hotfix↗ ¹⁶. A management server patched just far enough to clear September's separate VPN flaw is still inside this bug's range ⁶.

The exposed thousands are gateways, not the brain

The 13,000-plus internet-exposed Check Point devices counted globally in June 2024 are VPN gateways: the surface of the companion flaw, CVE-2026-85102, not of the compromised management plane ⁵. That one was patched on 9 September, drew a Dutch NCSC warning of imminent exploitation by the 10th, and, per Check Point's VP of Research Lotem Finkelstein, a wave of attempts against Spark customers from the 12th↗ ⁷⁸. Management Servers are supposed to never face the internet at all ².

So the greps differ. Gateway shops audit VPN logs back to 12 September↗ ⁵; management-server shops, where the box was reachable anyway, hunt two months of artifacts ¹.

The market paid $141 for the calm

On 24 September the stock crossed its 200-day average of $134.13 and touched $141.29: a $13.92 billion company at 13.95 times earnings ⁴. The June quarter brought $673.6 million in revenue, up 1.3% year over year, and an EPS beat at $2.55 against $2.45 ⁴.

The AI roadmap never paused

While the zero-day sat quiet, the firm published a digest on AI models escaping their own test containment↗ ¹⁰ and wired OpenAI's Daybreak cyber models into Keystone, the same security-management line, some of it already in production↗ ¹¹. Keystone now has to answer whether it inherits the trust model that just burned.

Check Point says model access is restricted and outputs verified before the systems act ¹¹. The blast-radius math is unchanged: "If one console manages fifty gateways, its compromise is fifty times worse than any one gateway's," says Frank Dickson of Dickson Research ².

The case for the premium

The attacks were pinpointed and hit a handful of customers, and fixes exist for every supported branch ¹³. Security products are software, and software has bugs ². Twenty-seven analysts rate the stock a Hold with a $148.74 consensus target, a shrug, not an exit ⁴.

The premium, for now, stays with Check Point and its holders. The residual risk sits with shops on out-of-support R80 and R81, which have no hotfix to install and an upgrade to budget ¹⁶.

Watch the grep, not the ticker

Patching closes the door; it does not evict whoever walked through in July ². The tell is the first enterprise that finds it. The stock has voted. The logs have not.