Check Point confirms attacks on VPN Security Gateway RCE flaw

Check Point has confirmed that attackers are actively exploiting CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product.

The same advisory warns of a second flaw, CVE-2026-93616, a pre-authentication path traversal in the Management web service that allows script execution and Java class loading. According to Check Point, this bug has been exploited as a zero-day since July 23.

Timeline

As early as September 10, the Dutch Nationaal Cyber Security Centrum (NCSC) flagged the Security Gateway issue and urged users to apply available updates, warning that exploitation was imminent. Check Point has now confirmed malicious activity began on September 12, with attackers hiding their location behind VPN services and proxies.

"Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers," the company's alert reads. The attempts used certificates with the subjects CN=vpn,OU=users,O=global, CN=vpn-user,OU=users,O=global, and CN=vpnuser,OU=users,O=global. The firm cautioned that these reflect only current observations and that more may be in use.

CISA has added both flaws to its Known Exploited Vulnerabilities (KEV) catalog, directing federal agencies to apply fixes or mitigations by September 25, 2026.

What to do

Check Point recommends installing LivePatch Take 26 on supported R81.20, R82, or R82.10 gateways, or a fixed Jumbo Hotfix (R81.20 Take 166, R82 Take 126, R82.10 Take 44, R81.10 Take 190, or later). Spark firewalls should be updated to R82.00.10 Build 2325 or R81.10.17 Build 4968 or later. Administrators can verify LivePatch is active with cpinfo -y CPupdates in expert mode; those who previously installed an offline LivePatch package need Take 26 for full coverage.

If updating isn't possible, the company advises disabling VPN implied rules and creating explicit rules that restrict Site-to-Site VPN over UDP/500 and UDP/4500 to specific peer IPs. For Remote Access VPN, only required services over UDP/500, UDP/4500, TCP/443, and TCP/80 should be allowed, with source client IP ranges restricted where possible. These measures do not apply to locally managed Spark firewalls.

Source: Bleeping Computer