Check Point has disclosed that threat actors are actively exploiting CVE-2026-85102, a pre-authentication remote code execution vulnerability affecting the VPN certificate-handling component of its Security Gateway product. A second flaw, CVE-2026-93616, a pre-authentication path traversal issue in the Management web service that permits script execution and Java class loading, is also being targeted in the wild.

The path traversal vulnerability has been under active exploitation as a zero-day since July 23, according to Check Point's advisory. The Dutch Nationaal Cyber Security Centrum (NCSC) issued an alert on September 10 regarding the Security Gateway vulnerability, warning that exploitation was imminent and recommending immediate patching.

Check Point confirmed that malicious activity targeting the RCE flaw commenced on September 12, with attackers leveraging VPNs and proxy services to obscure their origins. "Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers," the company stated. "The attempts originated from anonymization infrastructure, including VPN services and proxies."

The attackers employed certificates bearing the following subject names:

  • CN=vpn,OU=users,O=global
  • CN=vpn-user,OU=users,O=global
  • CN=vpnuser,OU=users,O=global

Check Point cautioned that these three certificate subjects represent only what has been observed thus far, and additional variants may be in circulation.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has cataloged both vulnerabilities in its Known Exploited Vulnerabilities (KEV) list, directing federal agencies to deploy available patches or implement mitigations by September 25, 2026.

Mitigating the risk

For CVE-2026-85102, Check Point advises administrators to deploy Check Point LivePatch Take 26 on supported R81.20, R82, or R82.10 gateways. Alternatively, organizations can install a fixed Jumbo Hotfix: R81.20 Take 166, R82 Take 126, R82.10 Take 44, R81.10 Take 190, or later versions.

Spark firewall customers should upgrade to R82.00.10 Build 2325 or R81.10.17 Build 4968, or later.

System administrators can verify LivePatch activation by executing the cpinfo -y CPupdates command on the Security Gateway in expert mode. Check Point notes that certain customers who deployed an earlier offline LivePatch package will require Take 26 to achieve complete coverage.

When patching is not immediately feasible, Check Point recommends disabling VPN implied rules and establishing explicit rules that confine Site-to-Site VPN traffic to UDP/500 and UDP/4500 ports directed toward specific peer IP addresses.

For Remote Access VPN deployments, restrict permitted services to UDP/500, UDP/4500, TCP/443, and TCP/80 where necessary, and limit source client IP ranges to the extent possible.

Check Point clarifies that these mitigation strategies do not extend to locally managed Spark firewalls. Organizations seeking mitigation and threat hunting guidance for CVE-2026-93616 should consult Check Point's dedicated support documentation.