Check Point warns of hackers exploiting Security Gateway VPN RCE flaw
Check Point confirms active exploitation of pre-auth VPN RCE CVE-2026-85102 and zero-day CVE-2026-93616, now both in CISA KEV.
Check Point confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution flaw in Security Gateway VPN certificate handling. The advisory also says CVE-2026-93616, a pre-authentication path traversal in the Management web service that can allow script execution and Java class loading, has been exploited as a zero-day since July 23, 2026. Attempts against Spark customers began on September 12 from VPN and proxy infrastructure, using observed certificate subjects such as CN=vpn, OU=users, O=global. CISA added both vulnerabilities to the KEV catalog and told federal agencies to remediate by September 25, 2026; fixes include LivePatch Take 26 and specified Jumbo Hotfix takes.
- CVE-2026-85102 is pre-auth RCE in VPN certificate handling.
- CVE-2026-93616 has been exploited as a zero-day since July 23.
- Spark exploitation attempts began September 12 via VPNs and proxies.
- CISA added both flaws to KEV with a September 25 deadline.
- Fixes include LivePatch Take 26 and listed Jumbo Hotfix takes.
- Vendors
- Check Point
- Victims
- Check Point Spark customers
- Organizations
- CISANational Cyber Security Centre
- Countries
- NetherlandsUnited States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85102 | Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw | 9.8 | 54% | KEVPoC | KEV |
| CVE-2026-93616 | Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload | 9.8 | 92% | KEVPoC | KEV |
From the original article
2 min read at bleepingcomputer.com
Cybersecurity company Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.