--- title: "Attackers Sat Inside Check Point's Firewall Brain for Two Months. The Stock Went Up." description: "Check Point says attackers held unauthenticated code execution on its Management Server, the machine that writes policy for every gateway it manages, from 23 July to 22 September. The stock spent disclosure week crossing its 200-day average at 13.95 times earnings." publisher: "The Inference" section: "Security" published: 2026-09-29T23:35:03.566Z modified: 2026-09-29T23:35:03.566Z canonical: https://theinference.org/article/attackers-sat-inside-check-point-s-firewall-brain-for-two-months-the-stock-went-up language: en keywords: "Cybersecurity, Vulnerabilities, Check Point, Stocks, Enterprise Software" --- # Attackers Sat Inside Check Point's Firewall Brain for Two Months. The Stock Went Up. > Check Point says attackers held unauthenticated code execution on its Management Server, the machine that writes policy for every gateway it manages, from 23 July to 22 September. The stock spent disclosure week crossing its 200-day average at 13.95 times earnings. ## The grep that tells you July happened Somewhere this week an administrator is running a one-line grep over the logs of the machine that writes firewall policy for the entire company. Check Point's advisory asks for it: [the search for oversized login names](https://tech.yahoo.com/cybersecurity/articles/control-tower-left-unguarded-check-094326324.html) is how a shop learns whether CVE-2026-93616, a pre-authentication path traversal rated 9.8 out of 10, let a stranger run scripts on the Management Server without a password [1]. "You don't need to break the firewall when you can tell it what to allow," says Aaron Beardslee, [manager of threat research at Securonix](https://www.csoonline.com/article/4225812/check-point-hacked-the-security-software-protecting-your-network-has-become-a-prime-attack-target.html) [2]. Attackers held that ground from 23 July [until the fix landed on 22 September](https://www.securityweek.com/check-point-patches-exploited-management-server-zero-day/) [1][3]. The same week, the stock [crossed its 200-day average](https://www.marketbeat.com/instant-alerts/price-check-point-software-technologies-nasdaq-chkp-share-price-breaks-above-200-day-moving-average-time-to-sell-2026-09-25/) [4]. ## Two months of quiet, then three days of law CISA put both Check Point flaws, each rated 9.8, into one Known Exploited Vulnerabilities batch on 22 September, giving federal agencies [until the 25th under BOD 26-04](https://forkast.news/the-vpn-certificate-bypass-that-was-patched-in-september-is-now-actively-exploited-federal-deadline-hits-sep-25/) [3][5]. The vendor's quiet window ran two months [1]; the government's remediation window ran three days [3][5]. The fix does not reach everyone. Every legacy R80 and R81 release is affected and out of support, so [the only remediation is an upgrade, not a hotfix](https://thehackernews.com/2026/09/check-point-warns-of-management-server.html) [1][6]. A management server patched just far enough to clear September's separate VPN flaw is still inside this bug's range [6]. ## The exposed thousands are gateways, not the brain The 13,000-plus internet-exposed Check Point devices counted globally in June 2024 are VPN gateways: the surface of the companion flaw, CVE-2026-85102, not of the compromised management plane [5]. That one was patched on 9 September, drew a Dutch NCSC warning of imminent exploitation by the 10th, and, per Check Point's VP of Research Lotem Finkelstein, [a wave of attempts against Spark customers from the 12th](https://www.bleepingcomputer.com/news/security/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw/) [7][8]. Management Servers are supposed to never face the internet at all [2]. *Chart: **Two months of quiet access, against three days of federal deadline** Column chart comparing the 61 days attackers held Check Point's Management Server against the zero days between patch and CISA listing, and the three days CISA gave federal agencies to remediate.* *Days in each window as stated by Check Point's advisory, SecurityWeek and Forkast News. Dwell computed from the disclosed dates, 23 July to 22 September 2026; the patch and CISA's Known Exploited Vulnerabilities listing both fell on 22 September. [1][3][5]* So the greps differ. Gateway shops [audit VPN logs back to 12 September](https://www.helpnetsecurity.com/2026/09/23/check-point-f5-big-ip-apm-zero-days-targeted/) [5]; management-server shops, where the box was reachable anyway, hunt two months of artifacts [1]. ## The market paid $141 for the calm On 24 September the stock crossed its 200-day average of $134.13 and touched $141.29: a $13.92 billion company at 13.95 times earnings [4]. The June quarter brought $673.6 million in revenue, up 1.3% year over year, and an EPS beat at $2.55 against $2.45 [4]. *Chart: **Revenue is still growing; operating income has fallen year over year for four quarters** Line chart of year-over-year growth for revenue and operating income across four quarters: revenue growth falls from 6.7 to 1.3 percent while operating income growth stays negative, between minus 5.3 and minus 9.1 percent.* *Year-over-year change by calendar quarter, September 2025 through June 2026, from Check Point's SEC filings. Revenue reached $673.6 million in the June quarter; operating income was $185.1 million. [9]* ## The AI roadmap never paused While the zero-day sat quiet, the firm [published a digest on AI models escaping their own test containment](https://securitymea.com/2026/09/21/check-point-reveals-ai-models-breached-their-own-containment/) [10] and wired [OpenAI's Daybreak cyber models](https://theinference.org/markets/companies/openai) into Keystone, the same security-management line, [some of it already in production](https://ciso.economictimes.indiatimes.com/news/corporate/check-point-integrates-openai-daybreak-models-into-security-workflows/134449771) [11]. Keystone now has to answer whether it inherits the trust model that just burned. Check Point says [model access is restricted and outputs verified before the systems act](https://theinference.org/article/palo-alto-rents-out-the-cyber-models-anthropic-and-openai-keep-locked) [11]. The blast-radius math is unchanged: "If one console manages fifty gateways, its compromise is fifty times worse than any one gateway's," says Frank Dickson of Dickson Research [2]. ## The case for the premium The attacks were pinpointed and hit a handful of customers, and fixes exist for every supported branch [1][3]. Security products are software, and software has bugs [2]. Twenty-seven analysts rate the stock a Hold with a $148.74 consensus target, a shrug, not an exit [4]. The premium, for now, stays with Check Point and its holders. The residual risk sits with shops on out-of-support R80 and R81, which have no hotfix to install and an upgrade to budget [1][6]. ## Watch the grep, not the ticker Patching closes the door; it does not evict whoever walked through in July [2]. The tell is the first enterprise that finds it. The stock has voted. The logs have not. ## Takeaway Attackers held code execution on Check Point's policy-writing Management Server for 61 days before the 22 September fix, and CISA gave federal agencies three days to remediate. The stock crossed its 200-day average that week at 13.95 times earnings, while shops on out-of-support R80 and R81 have no hotfix to install. ## Sources 1. [Yahoo Tech, The Control Tower Left Unguarded: Check Point's Management Server Zero-Day Gave Attackers Two Months of Silent Access, 25 September 2026](https://tech.yahoo.com/cybersecurity/articles/control-tower-left-unguarded-check-094326324.html) 2. [CSO Online, Check Point hacked: The security software protecting your network has become a prime attack target, September 2026](https://www.csoonline.com/article/4225812/check-point-hacked-the-security-software-protecting-your-network-has-become-a-prime-attack-target.html) 3. [SecurityWeek, Check Point Patches Exploited Management Server Zero-Day, 22 September 2026](https://www.securityweek.com/check-point-patches-exploited-management-server-zero-day/) 4. [MarketBeat, Check Point Software Technologies (NASDAQ:CHKP) Share Price Breaks Above 200-Day Moving Average, 25 September 2026](https://www.marketbeat.com/instant-alerts/price-check-point-software-technologies-nasdaq-chkp-share-price-breaks-above-200-day-moving-average-time-to-sell-2026-09-25/) 5. [Forkast News, The VPN Certificate Bypass That Was Patched in September Is Now Actively Exploited, Federal Deadline Hits Sep 25, 25 September 2026](https://forkast.news/the-vpn-certificate-bypass-that-was-patched-in-september-is-now-actively-exploited-federal-deadline-hits-sep-25/) 6. [The Hacker News, Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks, 22 September 2026](https://thehackernews.com/2026/09/check-point-warns-of-management-server.html) 7. [BleepingComputer, Check Point warns of hackers exploiting Security Gateway VPN RCE flaw, 23 September 2026](https://www.bleepingcomputer.com/news/security/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw/) 8. [Help Net Security, Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances, 23 September 2026](https://www.helpnetsecurity.com/2026/09/23/check-point-f5-big-ip-apm-zero-days-targeted/) 9. [Sharadar quarterly fundamentals, from Check Point Software's SEC filings, retrieved 27 September 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001015922) 10. [Security MEA, Check Point Reveals AI Models Breached Their Own Containment, 21 September 2026](https://securitymea.com/2026/09/21/check-point-reveals-ai-models-breached-their-own-containment/) 11. [ET CISO, Check Point integrates OpenAI Daybreak models into security workflows, September 2026](https://ciso.economictimes.indiatimes.com/news/corporate/check-point-integrates-openai-daybreak-models-into-security-workflows/134449771) --- Attackers Sat Inside Check Point's Firewall Brain for Two Months. The Stock Went Up. — The Inference. Canonical: https://theinference.org/article/attackers-sat-inside-check-point-s-firewall-brain-for-two-months-the-stock-went-up