Check Point confirmed that attackers are actively exploiting a pre-authentication remote command execution vulnerability in the VPN certificate-processing function within its Security Gateway product. The vulnerability is tracked as CVE-2026-85102, making exposed VPN gateways a potential entry point before a user proves their identity.
The company’s notice also warns of the exploitation of a second path-traversal vulnerability, tracked as CVE-2026-93616, affecting the Management web service. This vulnerability may enable script execution and the loading of Java classes, and Check Point says it has been exploited as a zero-day since July 23, 2026.
What did Check Point detect?
The Dutch National Cyber Security Centre pointed to the Security Gateway issue on September 10 and urged users to install the available updates in anticipation of imminent exploitation. Check Point says the wave of exploitation attempts began on September 12 and targeted Spark customers, using VPN services and proxies to conceal the attacks’ source.
The company observed certificates bearing the following subjects: CN=vpn,OU=users,O=global, CN=vpn-user,OU=users,O=global, and CN=vpnuser,OU=users,O=global. However, it clarified that these values reflect current observations only, and attackers may use other subjects.
CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog and asked U.S. federal agencies to apply fixes or mitigation measures by September 25, 2026.
What should system administrators do?
For CVE-2026-85102, Check Point recommends installing LivePatch Take 26 on supported gateways running R81.20, R82, or R82.10, or installing the Jumbo Hotfix in version R81.20 Take 166, R82 Take 126, R82.10 Take 44, or R81.10 Take 190, or any later version. Spark firewalls should also be updated to R82.00.10 Build 2325 or R81.10.17 Build 4968, or later.
LivePatch activation can be verified by running the command cpinfo -y CPupdates on the Security Gateway in expert mode. The company cautions that some customers who previously installed the offline LivePatch package need Take 26 to obtain full coverage.
Mitigation options when updating is not possible
If the update cannot be installed, Check Point recommends disabling implicit VPN rules and creating explicit rules that restrict Site-to-Site VPN on UDP/500 and UDP/4500 to specified peer IP addresses. For Remote Access VPN, permitted services should be limited to those required over UDP/500, UDP/4500, TCP/443, and TCP/80 when necessary, while source client address ranges should be restricted wherever possible.
Check Point explains that these measures do not apply to locally managed Spark firewalls. For CVE-2026-93616, it refers readers to a support article containing mitigation guidance and instructions for searching for indicators of compromise.
Why does this matter?
The shift from anticipated exploitation to confirmed exploitation raises the practical priority of remediation, particularly because one of the vulnerabilities does not require authentication and the other was exploited before its disclosure. However, the source does not specify the number of victims or the nature of the targeted data; therefore, the practical priority remains to identify exposed gateways, verify the patch level, and review VPN and management-service logs for unusual activity.