Check Point confirms active exploitation of a critical Security Gateway VPN RCE vulnerability

Check Point confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution vulnerability in the VPN certificate-handling functionality of its Security Gateway product. The same advisory also covers CVE-2026-93616, a pre-authentication path traversal flaw in the Management web service that can allow script execution and Java class loading. The company says the latter has been exploited as a zero-day since July 23, and that malicious activity began on September 12, 2026.