Check Point warns of hackers exploiting Security Gateway VPN RCE flaw
Check Point warns of active exploitation of two critical vulnerabilities in its Security Gateway VPN.
Summary
Cybersecurity firm Check Point has confirmed active exploitation of CVE-2026-85102, a remote code execution flaw in its Security Gateway VPN, and CVE-2026-93616, a path traversal vulnerability in the Management web service. The latter has been exploited as a zero-day since July 23, with malicious activity for the former beginning on September 12, using VPNs and proxies to mask attacker locations. CISA has added both flaws to its Known Exploited Vulnerabilities catalog, urging federal agencies to patch by September 25, 2026.
Full text
Check Point warns of hackers exploiting Security Gateway VPN RCE flaw By Bill Toulas September 23, 2026 03:53 PM 0 Cybersecurity company Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product. The same advisory also warns of threat actors exploiting a pre-authentication path traversal flaw tracked as CVE-2026-93616, which impacts the Management web service and can allow script execution and Java class loading. The company says that CVE-2026-93616 has been exploited as a zero-day since July 23. On September 10, the Dutch Nationaal Cyber Security Centrum (NCSC) alerted of the Security Gateway issue and urged users to apply available security updates as imminent exploitation was expected. Check Point has now confirmed that malicious activity started on September 12, with attackers using VPNs and proxies to hide their location. “Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers,” reads Check Point’s alert. “The attempts originated from anonymization infrastructure, including VPN services and proxies," the company said, adding that certificates with the following subjects were used: CN=vpn,OU=users,O=global CN=vpn-user,OU=users,O=global CN=vpnuser,OU=users,O=global However, the cybersecurity company noted that the three subjects only reflect current observations and more may be in use. CISA has now added the two flaws in its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to apply the available fixes and/or mitigations by September 25, 2026. Mitigating the risk Check Point’s advisory on CVE-2026-85102 recommends that administrators install Check Point LivePatch Take 26 on supported R81.20, R82, or R82.10 gateways, or install a fixed Jumbo Hotfix: R81.20 Take 166, R82 Take 126, R82.10 Take 44, or R81.10 Take 190, or later. Customers should also update Spark firewalls to R82.00.10 Build 2325 or R81.10.17 Build 4968, or later. System administrators are advised to verify if LivePatch is active by running the cpinfo -y CPupdates command on the Security Gateway in expert mode. The advisory specifically warns that some customers who installed an earlier offline LivePatch package need Take 26 for full coverage. If updating isn’t possible, it is recommended to disable the VPN implied rules and create explicit rules that restrict Site-to-Site VPN on UDP/500 and UDP/4500 to specific peer IP addresses. For Remote Access VPN, allow only the required services over UDP/500, UDP/4500, TCP/443, and TCP/80 where applicable, and restrict source client IP ranges where possible. Check Point notes that these mitigation measures do not apply to locally managed Spark firewalls. For mitigation and hunting advice for the Management web service CVE-2026-93616, Check Point points to this support article. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat Related Articles: Hackers start exploiting critical WordPress flaw for code executionNew Check Point flaw lets hackers execute code with root privilegesDutch NCSC: Critical Check Point VPN flaws exploitation is imminentCritical Elementor Pro flaw exploited to take over WordPress sitesHackers exploit Sangoma Switchvox flaw to deploy reverse shells
Indicators of Compromise
- cve — CVE-2026-85102
- cve — CVE-2026-93616