--- title: Check Point warns of hackers exploiting Security Gateway... description: Check Point has confirmed active exploitation of two vulnerabilities: CVE-2026-85102, a pre-authentication RCE flaw in Security Gateway's VPN... canonical: https://daily.dev/posts/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw-zgaiekhj7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Check Point warns of hackers exploiting Security Gateway VPN RCE flaw | daily.dev og:description: Check Point has confirmed active exploitation of two vulnerabilities: CVE-2026-85102, a pre-authentication RCE flaw in Security Gateway's VPN... og:url: https://daily.dev/posts/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw-zgaiekhj7 og:image: https://api.daily.dev/og/posts/zGAIEKHJ7.png og:image:alt: Check Point warns of hackers exploiting Security Gateway VPN RCE flaw og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Check Point warns of hackers exploiting Security Gateway VPN RCE flaw **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Check Point has confirmed active exploitation of two vulnerabilities: CVE-2026-85102, a pre-authentication RCE flaw in Security Gateway's VPN certificate-handling, and CVE-2026-93616, a path traversal flaw in the Management web service exploited as a zero-day since July 23. Attackers began exploiting Spark customers on September 12 using anonymization infrastructure and specific VPN certificate subjects. CISA added both flaws to its Known Exploited Vulnerabilities catalog, giving federal agencies until September 25, 2026 to remediate. Check Point recommends installing LivePatch Take 26 or specific Jumbo Hotfixes, updating Spark firewalls, and applying VPN access restrictions as mitigations if patching isn't immediately possible. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-85102 and how is it being exploited? CVE-2026-85102 is a pre-authentication remote code execution vulnerability in the VPN certificate-handling functionality of Check Point's Security Gateway product. Check Point observed a wave of exploitation attempts against Spark customers starting September 12, 2026, originating from anonymization infrastructure including VPN services and proxies, using certificates with subjects like CN=vpn,OU=users,O=global. _Teams running Check Point gateways can track exploitation details like this through daily.dev to prioritize patching._ ### How do I patch CVE-2026-85102 on Check Point Security Gateway? Administrators should install Check Point LivePatch Take 26 on supported R81.20, R82, or R82.10 gateways, or apply a fixed Jumbo Hotfix: R81.20 Take 166, R82 Take 126, R82.10 Take 44, or R81.10 Take 190, or later. Spark firewalls should be updated to R82.00.10 Build 2325 or R81.10.17 Build 4968, or later. Verify LivePatch status with the cpinfo -y CPupdates command in expert mode. _Anyone rolling out this Check Point fix can follow ongoing coverage of exploitation and mitigation steps on daily.dev._ ### What should I do if I can't immediately patch the Check Point VPN vulnerability? If updating is not possible, disable the VPN implied rules and create explicit rules restricting Site-to-Site VPN on UDP/500 and UDP/4500 to specific peer IP addresses. For Remote Access VPN, allow only required services over UDP/500, UDP/4500, TCP/443, and TCP/80, and restrict source client IP ranges. Note these mitigations do not apply to locally managed Spark firewalls. _daily.dev helps security teams weighing stopgap mitigations against full patches stay current on advisories like this._ ## Similar posts on daily.dev - [Critical Check Point VPN Zero-Day Exploited in the Wild \(CVE-2026-50751\)](https://daily.dev/posts/critical-check-point-vpn-zero-day-exploited-in-the-wild-cve-2026-50751--8lk5ari1g) · Rapid7 Cybersecurity Blog · 1 upvotes · 0 comments - [Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent](https://daily.dev/posts/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent-vxhgmujuj) · BleepingComputer · 0 upvotes · 0 comments - [Check Point warns of ransomware-linked attacks exploiting outdated VPN protocol](https://daily.dev/posts/check-point-warns-of-ransomware-linked-attacks-exploiting-outdated-vpn-protocol-ljwrt6vob) · CSO Online · 0 upvotes · 0 comments - [Check Point VPN Authentication Bypass \(CVE-2026-50751\): Client-Controlled IKEv1 Auth Flipped by Ransomware Affiliate](https://daily.dev/posts/check-point-vpn-authentication-bypass-cve-2026-50751-client-controlled-ikev1-auth-flipped-by-rans-ehcuolknf) · Latest Hacking News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vpn](https://daily.dev/tags/vpn) [View this post on daily.dev](https://daily.dev/posts/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw-zgaiekhj7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Check Point warns of hackers exploiting Security Gateway VPN RCE flaw","url":"https://daily.dev/posts/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw-zgaiekhj7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw-zgaiekhj7"},"datePublished":"2026-09-23T19:56:45.821Z","dateModified":"2026-09-24T02:30:09.743Z","description":"Check Point has confirmed active exploitation of two vulnerabilities: CVE-2026-85102, a pre-authentication RCE flaw in Security Gateway's VPN...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d0fb4c01d52f8196036ecae2a95d7118?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d0fb4c01d52f8196036ecae2a95d7118?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw-zgaiekhj7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vpn","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Check Point warns of hackers exploiting Security Gateway VPN RCE flaw"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw-zgaiekhj7#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-85102 and how is it being exploited?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-85102 is a pre-authentication remote code execution vulnerability in the VPN certificate-handling functionality of Check Point's Security Gateway product. Check Point observed a wave of exploitation attempts against Spark customers starting September 12, 2026, originating from anonymization infrastructure including VPN services and proxies, using certificates with subjects like CN=vpn,OU=users,O=global. Teams running Check Point gateways can track exploitation details like this through daily.dev to prioritize patching."}},{"@type":"Question","name":"How do I patch CVE-2026-85102 on Check Point Security Gateway?","acceptedAnswer":{"@type":"Answer","text":"Administrators should install Check Point LivePatch Take 26 on supported R81.20, R82, or R82.10 gateways, or apply a fixed Jumbo Hotfix: R81.20 Take 166, R82 Take 126, R82.10 Take 44, or R81.10 Take 190, or later. Spark firewalls should be updated to R82.00.10 Build 2325 or R81.10.17 Build 4968, or later. Verify LivePatch status with the cpinfo -y CPupdates command in expert mode. Anyone rolling out this Check Point fix can follow ongoing coverage of exploitation and mitigation steps on daily.dev."}},{"@type":"Question","name":"What should I do if I can't immediately patch the Check Point VPN vulnerability?","acceptedAnswer":{"@type":"Answer","text":"If updating is not possible, disable the VPN implied rules and create explicit rules restricting Site-to-Site VPN on UDP/500 and UDP/4500 to specific peer IP addresses. For Remote Access VPN, allow only required services over UDP/500, UDP/4500, TCP/443, and TCP/80, and restrict source client IP ranges. Note these mitigations do not apply to locally managed Spark firewalls. daily.dev helps security teams weighing stopgap mitigations against full patches stay current on advisories like this."}}]} ```