Check Point Warns of Hackers Exploiting Security Gateway VPN RCE Flaw

Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product. The company says malicious activity began targeting the flaw on September 12, 2026, roughly five days after it first disclosed the bug — attackers are using anonymization infrastructure, including VPN services and proxies, to mask the origin of their attempts.

What Happened

Check Point originally disclosed CVE-2026-85102 alongside a companion flaw, CVE-2026-85103, on September 7, 2026, updating the advisory on September 9. At that time the company said it had discovered both issues internally and found no evidence of in-the-wild exploitation. That assessment held for barely three days: on September 10, the Dutch Nationaal Cyber Security Centrum (NCSC) warned that exploitation appeared imminent and urged customers to apply the available updates immediately. Check Point has now confirmed the NCSC's warning was correct, reporting a wave of exploitation attempts against Spark small-business firewall customers beginning September 12.

On September 22, 2026, the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-85102 to its Known Exploited Vulnerabilities (KEV) catalog — listed as a "Check Point Multiple Products Improper Certificate Validation Vulnerability" — alongside three other actively exploited bugs disclosed the same week. That listing triggers Binding Operational Directive 26-04, giving federal civilian agencies until September 25, 2026 to remediate.

VPN Certificate Handling — and Why This Matters

CVE-2026-85102 stems from a failure to properly validate certificate trust during VPN negotiation on Security Gateway and Spark Firewall devices configured for Site-to-Site VPN or Remote Access VPN. Because the flaw lives in the certificate-trust logic itself, exploitation does not require a valid account, a client certificate issued by the organization, or any prior access — an unauthenticated remote attacker who can reach a gateway's VPN service can attempt to run arbitrary code on it directly.

The companion bug, CVE-2026-85103, is a heap-based buffer overflow triggered while the product decodes the ASN.1 structure of a VPN certificate, and it carries the same 9.8 severity. It additionally affects Security Management Server, widening the blast radius beyond gateways to the management plane that configures them. As of this writing, public reporting indicates only CVE-2026-85102 has been added to the CISA KEV catalog, though both remain critical, unauthenticated RCE paths into VPN infrastructure that many organizations expose directly to the internet.

These two flaws also arrive on the heels of a separate, already-exploited Check Point zero-day: CVE-2026-93616, a pre-authentication path traversal in the Management web service that Check Point says has been under active attack since July 23, 2026. Together, the three vulnerabilities mean Check Point's VPN and management infrastructure has faced sustained targeting for roughly two months.

Vulnerability Details

Confirmed Exploitation and Attribution

Check Point has not attributed the activity to a named threat actor or group. The company reports that attackers behind the September 12 wave used anonymization infrastructure, including VPN services and proxies, to obscure the source of their connections, complicating network-level attribution and IP-based blocking.

Observed attack traffic has relied on attacker-supplied VPN certificates carrying distinguishing subject fields, including:

• CN=vpn,OU=users,O=global
• CN=vpn-user,OU=users,O=global
• CN=vpnuser,OU=users,O=global

Security teams can hunt for connection attempts presenting certificates with these or similarly generic O=global subject patterns in VPN negotiation logs. Because the underlying bug is a certificate-trust validation failure, defenders should treat any successful VPN negotiation using an unrecognized or self-signed certificate bearing these patterns as a potential compromise indicator, not just a logging curiosity.

Check Point's Guidance

Check Point's advisory and subsequent updates recommend:

• Patch immediately — install LivePatch Take 26 on supported R81.20, R82, or R82.10 gateways, or apply the corresponding Jumbo Hotfix (R81.20 Take 166, R82 Take 126, R82.10 Take 44, R81.10 Take 190, or later)
• Update Spark firewalls to R82.00.10 Build 2325 or R81.10.17 Build 4968, or later
• Verify LivePatch status by running cpinfo -y CPupdates in expert mode on the Security Gateway
• If immediate patching isn't possible, disable the VPN implied rules and create explicit firewall rules restricting Site-to-Site VPN traffic on UDP/500 and UDP/4500 to specific, known peer IP addresses
• Note the limits of the workaround — the peer-IP allow-list approach does not provide equivalent protection for Remote Access VPN environments serving roaming users with unpredictable source addresses; patching or LivePatch is the only complete remediation for those deployments
• Review VPN negotiation and gateway logs for connection attempts using unexpected or malformed certificates, including the generic subject patterns identified above

Why This Matters

Check Point Security Gateways and Spark Firewalls sit at the network perimeter for a large population of enterprise and small-business customers, and VPN services are, by design, exposed to the internet so that remote users and site-to-site peers can reach them. A pre-authentication RCE in the certificate-trust logic underpinning that exposure removes the one barrier — a valid credential or certificate — that would otherwise stand between an internet-based attacker and code execution on the gateway. The compressed timeline here is notable: Check Point moved from "no evidence of exploitation" to confirmed in-the-wild attacks in five days, and CISA followed with a KEV listing and a three-day federal remediation clock less than two weeks after disclosure. Combined with the still-active CVE-2026-93616 path traversal from July, organizations running Check Point VPN infrastructure are facing multiple, overlapping unauthenticated attack paths and should treat patching as urgent rather than routine.

Sources

• Check Point warns of hackers exploiting Security Gateway VPN RCE flaw — BleepingComputer
• Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE — The Hacker News
• CISA Adds Four Known Exploited Vulnerabilities to Catalog — CISA