Check Point has confirmed that two pre-authentication flaws in its Security Gateway product are under active exploitation, giving administrators of supported gateways a clear path to patch and a fallback set of firewall rules when patching is not yet possible.<\/p>\n
The cybersecurity company confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product. The same advisory also covers a second pre-authentication flaw, CVE-2026-93616, a path traversal issue in the Management web service that can permit script execution and Java class loading.<\/p>\n
CVE-2026-93616 has been exploited as a zero-day since July 23, 2026. For CVE-2026-85102, Check Point reported that malicious activity began on September 12, 2026, with attackers routing traffic through VPNs and proxies to obscure their origin.<\/p>\n
The advisory lists three certificate subjects seen during the September 12 wave of attempts against Spark customers:<\/p>\n
Check Point noted that these subjects reflect current observations and that additional variants may be in use.<\/p>\n
On September 10, 2026, the Dutch Nationaal Cyber Security Centrum (NCSC) alerted organizations to the Security Gateway issue and warned that imminent exploitation was expected. The Dutch alert preceded the on-network activity that Check Point later confirmed starting September 12, giving defenders a two-day window to apply updates before mass attempts began.<\/p>\n
CISA has now added both flaws to its Known Exploited Vulnerabilities (KEV) catalog and directed federal agencies to apply available fixes or mitigations by September 25, 2026.<\/p>\n
Check Point’s advisory on CVE-2026-85102 recommends that administrators install Check Point LivePatch Take 26 on supported R81.20, R82, or R82.10 gateways. Where LivePatch is not used, a fixed Jumbo Hotfix is required: R81.20 Take 166, R82 Take 126, R82.10 Take 44, or R81.10 Take 190, or later.<\/p>\n
Spark firewall customers should update to R82.00.10 Build 2325 or R81.10.17 Build 4968, or later. Check Point also warns that some customers who installed an earlier offline LivePatch package still need Take 26 for full coverage.<\/p>\n
Administrators can confirm that LivePatch is active by running the Where a fix cannot be applied immediately, Check Point recommends disabling the VPN implied rules and writing explicit rules that restrict Site-to-Site VPN on UDP\/500 and UDP\/4500 to specific peer IP addresses. For Remote Access VPN, the guidance is to allow only the required services over UDP\/500, UDP\/4500, TCP\/443, and TCP\/80 where applicable, and to restrict source client IP ranges where possible. Check Point notes that these mitigations do not apply to locally managed Spark firewalls.<\/p>\n For hunting and mitigation advice specific to the Management web service CVE-2026-93616, Check Point directs administrators to a separate support article.<\/p>\n Anyone running Security Gateway on a supported branch should treat the September 25 CISA deadline as a hard date and confirm LivePatch status before that day. Hunt for the three certificate subjects listed above in VPN logs, but treat that list as a starting point rather than a complete indicator set, since Check Point has stated that more subjects may be in use. For environments that cannot update in time, the explicit VPN rule set on UDP\/500, UDP\/4500, TCP\/443, and TCP\/80 reduces the exposed surface while the patch is staged.<\/p>\n CVE-2026-85102 is a pre-authentication remote code execution vulnerability in the VPN certificate-handling functionality of Check Point Security Gateway. Check Point confirmed active exploitation beginning on September 12, 2026.<\/p>\n Exploitation of CVE-2026-93616, a pre-authentication path traversal flaw in the Management web service, has been observed as a zero-day since July 23, 2026, according to Check Point.<\/p>\n CISA added both CVE-2026-85102 and CVE-2026-93616 to its Known Exploited Vulnerabilities catalog and set a remediation deadline of September 25, 2026 for federal agencies.<\/p>\ncpinfo -y CPupdates<\/code> command on the Security Gateway in expert mode.<\/p>\nMitigations when patching is not yet possible<\/h2>\n
What defenders should do next<\/h2>\n
FAQ<\/h2>\n
What is CVE-2026-85102?<\/h3>\n
When did exploitation of CVE-2026-93616 start?<\/h3>\n
What is the CISA deadline for these flaws?<\/h3>\n