Check Point warns of hackers exploiting Security Gateway VPN RCE flaw

Cybersecurity company Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product.

The same advisory also warns of threat actors exploiting a pre-authentication path traversal flaw tracked as CVE-2026-93616, which impacts the Management web service and can allow script execution and Java class loading.

The company says that CVE-2026-93616 has been exploited as a zero-day since July 23.

On September 10, the Dutch Nationaal Cyber Security Centrum (NCSC) alerted of the Security Gateway issue and urged users to apply available security updates as imminent exploitation was expected.

Check Point has now confirmed that malicious activity started on September 12, with attackers using VPNs and proxies to hide their location.

“Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers,” reads Check Point’s alert.

“The attempts originated from anonymization infrastructure, including VPN services and proxies," the company said, adding that certificates with the following subjects were used:

• CN=vpn,OU=users,O=global
• CN=vpn-user,OU=users,O=global
• CN=vpnuser,OU=users,O=global

However, the cybersecurity company noted that the three subjects only reflect current observations and more may be in use.

CISA has now added the two flaws in its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to apply the available fixes and/or mitigations by September 25, 2026.

Mitigating the risk

Check Point’s advisory on CVE-2026-85102 recommends that administrators install Check Point LivePatch Take 26 on supported R81.20, R82, or R82.10 gateways, or install a fixed Jumbo Hotfix: R81.20 Take 166, R82 Take 126, R82.10 Take 44, or R81.10 Take 190, or later.

Customers should also update Spark firewalls to R82.00.10 Build 2325 or R81.10.17 Build 4968, or later.

System administrators are advised to verify if LivePatch is active by running the cpinfo -y CPupdates command on the Security Gateway  in expert mode.

The advisory specifically warns that some customers who installed an earlier offline LivePatch package need Take 26 for full coverage.

If updating isn’t possible, it is recommended to disable the VPN implied rules and create explicit rules that restrict Site-to-Site VPN on UDP/500 and UDP/4500 to specific peer IP addresses.

For Remote Access VPN, allow only the required services over UDP/500, UDP/4500, TCP/443, and TCP/80 where applicable, and restrict source client IP ranges where possible.

Check Point notes that these mitigation measures do not apply to locally managed Spark firewalls.

For mitigation and hunting advice for the Management web service CVE-2026-93616, Check Point points to this support article.

Build your security blueprint for AI-powered attacks

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.

Save your seat