Check Point Security Gateways Targeted in Active Exploitation of Two VPN Flaws

Check Point has confirmed that attackers are actively exploiting two vulnerabilities affecting its Security Gateway products, including a pre-authentication remote code execution (RCE) flaw in VPN certificate handling.

Attackers Exploit Check Point VPN and Management Flaws

The first vulnerability, tracked as CVE-2026-85102, is a pre-authentication RCE vulnerability in the VPN certificate handling functionality of Check Point Security Gateway. Successful exploitation could allow attackers to execute code without authentication.

The advisory also warns that attackers are exploiting CVE-2026-93616, a pre-authentication path traversal vulnerability affecting management web services. The flaw may allow scripts to be executed or Java classes to be loaded.

According to Check Point, CVE-2026-93616 has been exploited as a zero-day since July 23.

On September 10, the Dutch National Cyber Security Centrum (NCSC) warned about an issue affecting its security gateway and urged users to install available security updates because exploitation was imminent.

Check Point said malicious activity began on September 12, with attackers using VPN services and proxies to hide their locations.

“Since September 12, 2026, we have observed a wave of exploitation attempts against Spark customers,” the company said in its security alert.

“This effort began with anonymization infrastructure such as VPN services and proxies,” Check Point said. The company also identified certificates using the following subjects:

• CN=VPN, OU=User, O=Global
• CN = VPN User, OU = User, O = Global
• CN=vpnuser, OU=user, O=global

Check Point noted that these certificate subjects reflect current observations only and that attackers may use additional subjects.

CISA Adds the Vulnerabilities to Its KEV Catalog

CISA added both flaws to its Known Exploited Vulnerabilities (KEV) Catalog. Federal agencies are required to apply available fixes or mitigations by September 25, 2026.

How to Mitigate the Check Point Vulnerabilities

In its CVE-2026-85102 advisory, Check Point recommends that administrators install Check Point LivePatch Take 26 on supported R81.20, R82, or R82.10 gateways.

Administrators can also install the following fixed jumbo hotfixes:

• R81.20 Take 166
• R82 Take 126
• R82.10 Take 44
• R81.10 Take 190 or later

Check Point also recommends updating Spark firewalls to R82.00.10 Build 2325 or R81.10.17 Build 4968 or later.

Administrators can check whether LivePatch is active by running the following command in expert mode on the Security Gateway:

cpinfo -y CP update

The advisory warns that some customers who installed previous offline LivePatch packages may still require Take 26 to receive full coverage.

If updating is not possible, Check Point recommends disabling VPN implicit rules and creating explicit rules that limit site-to-site VPN connections over UDP ports 500 and 4500 to specific peer IP addresses.

For remote access VPNs, allow only the necessary services over UDP ports 500 and 4500, as well as TCP ports 443 and 80 where applicable. Administrators should also limit the source client IP range whenever possible.

Check Point notes that these mitigations do not apply to locally managed Spark firewalls.

Mitigation and Hunting Guidance for CVE-2026-93616

For mitigation and threat-hunting guidance related to CVE-2026-93616 and Management Web Services, Check Point directs administrators to its support article.

Join Mikko Hypponen and security leaders from the NFL, Chanel, and Atlassian for a 2-hour digital summit about what will change with AI speed attacks, what defenders should stop doing, and how to verify, decide, fix, and revalidate at machine speed.

Reserve your seat