Cybersecurity
Check Point confirms exploitation of two gateway flaws
Check Point said attackers had been exploiting two pre-authentication vulnerabilities in its Security Gateway and management web service, with one used as a zero-day since 23 July and fixes now advised.
- Check Point confirmed active exploitation of CVE-2026-85102 in the VPN certificate-handling part of its Security Gateway product.
- The company said CVE-2026-93616 in the Management web service had been exploited as a zero-day since 23 July.
- Check Point said it saw a wave of exploitation attempts beginning on 12 September, and that the attempts used VPNs and proxies to obscure their source.
- The Dutch Nationaal Cyber Security Centrum warned about the Security Gateway issue on 10 September, and CISA later added both flaws to its Known Exploited Vulnerabilities catalogue.
- CISA told federal agencies to apply fixes or mitigations by 25 September 2026.
Check Point said CVE-2026-85102 was being actively exploited in the VPN certificate-handling part of its Security Gateway product. Its advisory also said CVE-2026-93616 affected the Management web service and could allow script execution and Java class loading.
The company said the second flaw had been used as a zero-day since 23 July. It said malicious activity began on 12 September and that the attempts came through anonymisation services, including VPNs and proxies.
Check Point said it had seen certificates with three subject lines during the activity, but that these were only the examples it had observed so far. The company said more subjects may also have been used.
On 10 September, the Dutch Nationaal Cyber Security Centrum warned about the Security Gateway issue and said users should install updates because exploitation was expected soon. CISA later added both flaws to its Known Exploited Vulnerabilities catalogue and set 25 September 2026 as the deadline for federal agencies to act.
For CVE-2026-85102, Check Point advised specific LivePatch or hotfix releases for supported R81.20, R82 and R82.10 gateways, and newer Spark firewall builds. Where updates were not possible, it recommended restricting VPN traffic more tightly and said the mitigation steps did not apply to locally managed Spark firewalls.
Named in this story
Companies
- Check Point
- confirmed active exploitation and issued mitigation advice
Governments and agencies
- Nationaal Cyber Security Centrum (NCSC)
- warned on 10 September about the Security Gateway issue
- CISA
- added both flaws to its Known Exploited Vulnerabilities catalog
Products and systems
- CVE-2026-85102
- is the pre-authentication remote code execution flaw in Security Gateway
- CVE-2026-93616
- is the pre-authentication path traversal flaw in the Management web service
- Security Gateway
- was the affected VPN product
- Management web service
- contained the path traversal flaw
- Spark
- was the product referenced in the exploitation attempts
How the source tells it
A plain security-advisory register, with urgency coming from the incident timeline and remediation instructions rather than from emotive framing.
No emotive framing was found in the original.