Check Point VPN Flaw Exploited in Attacks, Company Warns

Check Point has confirmed active attacks against a Check Point VPN flaw that can allow remote code execution before authentication. The company also warns that attackers are exploiting a separate flaw in its Management web service.

Attacks Against VPN Gateways Began in September

The VPN vulnerability, CVE-2026-85102, affects how Check Point Security Gateway handles certificates. Check Point says it observed a wave of exploitation attempts against Spark customers starting September 12, 2026.

Attackers routed their traffic through VPN services and proxies to conceal their locations. In addition, Check Point identified several certificate subjects used in the attempts. The company cautions that attackers may use others.

The separate Management web service flaw, CVE-2026-93616, involves path traversal. It can allow attackers to execute scripts and load Java classes before authentication. According to Check Point, attackers have exploited it since July 23.

CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog. Federal civilian agencies must apply fixes or mitigations by September 25.

Check Point Releases Patches and Mitigations

Administrators should patch the Check Point VPN flaw using the update appropriate for their gateway. Check Point recommends LivePatch Take 26 for supported R81.20, R82 and R82.10 gateways. It has also released fixed Jumbo Hotfix versions.

Meanwhile, Spark customers should update to R82.00.10 Build 2325 or R81.10.17 Build 4968, or a later version. Check Point warns that some customers who installed an earlier offline LivePatch package still need Take 26 for full coverage.

Where an immediate update is impossible, Check Point recommends restricting VPN traffic to required services and trusted source addresses. However, those mitigation steps do not apply to locally managed Spark firewalls.

Administrators should also follow Check Point’s separate guidance for investigating and addressing CVE-2026-93616.