Check Point says attackers are now exploiting a critical flaw in its Security Gateway VPN product, putting exposed gateways and Spark firewalls at risk. The bug, CVE-2026-85102, is a pre-authentication remote code execution flaw in VPN certificate handling; Check Point says attacks began on September 12 and used VPNs and proxies to hide origin. CISA added it to the Known Exploited Vulnerabilities catalog, and fixes are available via LivePatch Take 26 and updated Jumbo Hotfix builds for supported R81.10, R81.20, R82, and R82.10 releases.
Why it matters: Organizations using Check Point remote-access or site-to-site VPNs should treat this as urgent because attackers can exploit it before login. Apply the relevant Check Point updates immediately or use the vendor’s temporary network restrictions until patching is complete.
Bill Toulas
2026.09.23
100% relevant
The article establishes a distinct exploited Check Point event centered on CVE-2026-85102 in Security Gateway VPN, while also linking it operationally to the already tracked CVE-2026-93616 activity.
← Back to all stories