CERT24Check Point confirms active exploitation of critical Security Gateway VPN flawsLoading data…
CERT24Threat Observatory
Period

Check Point confirms active exploitation of critical Security Gateway VPN flaws

Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the Security Gateway VPN certificate-handling functionality. The company also reported exploitation of CVE-2026-93616, a pre-authentication path traversal flaw affecting the Management web service. Check Point said malicious activity began on September 12, 2026, and that attackers used VPNs and proxies to hide their location.

← Back to intelligence

Check Point confirms active exploitation of critical Security Gateway VPN flaws

Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the Security Gateway VPN certificate-handling functionality. The company also reported exploitation of CVE-2026-93616, a pre-authentication path traversal flaw affecting the Management web service. Check Point said malicious activity began on September 12, 2026, and that attackers used VPNs and proxies to hide their location.