Check Point VPN RCE flaw CVE-2026-85102 now exploited

Check Point has confirmed that attackers are exploiting CVE-2026-85102, a remote code execution (RCE) vulnerability in its Security Gateway product. The flaw sits in the code that handles VPN certificates, and it can be abused without authentication.

The same advisory covers a second exploited bug, CVE-2026-93616. It is a pre-authentication path traversal flaw in the Management web service that can lead to script execution and Java class loading. According to Check Point, attackers have used it as a zero-day since July 23.

Warning from the Netherlands came first

The Security Gateway issue was already on defenders' radar. On September 10, the Nationaal Cyber Security Centrum (NCSC), the Dutch government's national cybersecurity agency, warned about the flaw. It told users to install the available security updates because it expected exploitation soon.

That expectation proved correct. Check Point now says malicious activity began on September 12, two days after the Dutch alert.

"Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers," the company said in its alert. Spark is Check Point's firewall line.

The attackers hid their origin behind VPN services and proxies. Check Point said the attempts used certificates with these subjects:

• CN=vpn,OU=users,O=global
• CN=vpn-user,OU=users,O=global
• CN=vpnuser,OU=users,O=global

The company added that this list only reflects what it has seen so far, and that attackers may be using other certificate subjects as well.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. This is the agency's list of flaws confirmed to be abused in real attacks. Federal agencies must apply the fixes or mitigations by September 25, 2026.

Patches and workarounds

For CVE-2026-85102, Check Point recommends installing LivePatch Take 26 on supported R81.20, R82, or R82.10 gateways. Administrators can instead install a fixed Jumbo Hotfix:

• R81.20 Take 166
• R82 Take 126
• R82.10 Take 44
• R81.10 Take 190

Later versions are also covered. Spark firewalls should be updated to R82.00.10 Build 2325 or R81.10.17 Build 4968, or later.

To check whether LivePatch is active, administrators can run the cpinfo -y CPupdates command on the Security Gateway in expert mode. Check Point also warned that some customers who installed an earlier offline LivePatch package still need Take 26 for full protection.

Where patching is not possible, the company suggests disabling the VPN implied rules and writing explicit ones instead. For Site-to-Site VPN, UDP/500 and UDP/4500 should be restricted to specific peer IP addresses. For Remote Access VPN, only the required services should be allowed over UDP/500, UDP/4500, TCP/443, and TCP/80 where relevant, with source client IP ranges limited where possible.

These workarounds do not apply to locally managed Spark firewalls. For CVE-2026-93616, Check Point has published a separate support article with mitigation and hunting guidance.

Why It Matters

Edge devices such as VPN gateways and firewalls remain a favourite entry point for attackers. They face the internet, often run with high privileges, and a pre-authentication flaw means no stolen credentials are needed. This case fits a familiar pattern seen with other actively exploited vulnerabilities: a public warning, then attacks within days.

The two-day gap between the Dutch NCSC alert and the first exploitation wave suggests that patch windows for exposed network gear are now very short. It is also notable that the Management web service bug was abused for about two months before disclosure. Organisations running Check Point products should not only patch but also look for signs of earlier compromise.

It is worth watching whether more certificate subjects surface, and whether the activity broadens beyond Spark customers. As with the TeamCity flaw now used by ransomware gangs, widely exploited bugs can attract additional threat groups over time.