Check Point is warning its users over the active exploitation of CVE-2026-85102, a severe vulnerability in its Security Gateway product. This critical pre-authentication remote code execution flaw exists in the VPNs certificate-handling functionality. According to BleepingComputer , Check Point released a security bulletin confirming that threat actors have been actively exploiting this gap to conduct unauthorized attacks.
What makes this even more alarming is the fact that attackers are exploiting it before users have the chance to patch it. The situation mirrors a wave of similar threats targeting other significant platforms and frameworks such as WordPress or Metas Muse AI assistant. Cybersecurity leaders in your organization need to take immediate action to protect against these growing threats.
What happened
Check Point Software Technologies disclosed a critical vulnerability in its Security Gateway product on 23 September. The flaw, identified as CVE-2026-85102, is a pre-authentication remote code execution (RCE) vulnerability found in the VPN certificate-handling functionality. This means cybercriminals can exploit the flaw to execute arbitrary code on the server by sending specially crafted VPN certificates. The cybersecurity firm reports that threat actors have already started exploiting this flaw in the wild.
Check Point noted that exploitation is active. An earlier management server zero-day bug was detected by the company during an attack on July 23. That flaw was found in the Security Management Server, enabling unauthorized execution of scripts. Both vulnerabilities were swiftly patched the most recent exploit received its fix a day earlier on 23 September. The company advises all users to update their Security Gateway software immediately to the latest version.
The flaw is particularly serious because it allows attackers to execute malicious code on the targeted system. This can lead to a broad spectrum of malicious activities, such as data breaches, system hijacking, and unauthorized access to sensitive information.
The hackers exploit the vulnerability by sending customised VPN certificates to the impacted server. This action triggers the execution of malicious code without the need for user authentication. The critical nature of the flaw is underscored by its CVSS score of 9.8. This is on par with the severity of earlier bugs found in critical infrastructure such as the recent WordPress flaw (CVS-2026-87902), which allowed file manipulation for remote code execution.
Why it matters
Critical pre-authentication vulnerabilities in VPN software are especially alarming due to their potential for wide-scale exploitation. Check Point's advisory indicates that any device using the affected software is at risk if not patched. This makes prompt and coordinated response essential since these systems are often used for remote access and VPN setups.
Check Point Security's product portfolio is widely used in large enterprises, meaning this flaw puts a broad range of businesses at risk. In a report by BleedingComputer, Check Point has already documented active exploitation attempts.
Remote code execution vulnerabilities before user authentication are highly appealing targets for attackers. A flaw allows for the injection and execution of malicious code without the need for valid credentials, making it easier to infiltrate secure environments.
Businesses should prioritize this vulnerability because it can lead to significant data breaches and operational disruptions. The attacker can gain control over the server without any user interaction, making it difficult to detect and mitigate attacks early in the attack chain.
Another threat vector comes from the potential for lateral movement within a network. Once attackers gain access through a vulnerable VPN, they can spread to other connected systems. Security teams should be particularly cautious about network segmentation and access controls around VPN-enabled endpoints.
- This flaw is not isolated for Check Point products, but part of an overall theme of zero-day exploitation of network security flaws. This trend emphasizes the importance of continuous monitoring of network security infrastructures.
- The potential impact on businesses underscores the need for robust security practices and timely updates. Cybersecurity vendors provide regular updates on vulnerabilities and known exploits. Regular patching and system updates are essential to ensure systems remain secure against active threats.
What to do
- Apply the patch released by Check Point on September 23, 2026, as soon as possible. This will fix the pre-authentication remote code execution vulnerability, which was actively exploited via CVE-2026-85102.
- Update your Security Gateway product version to the latest version available from Check Point. Check Point issued patches for management server zero-day vulnerabilities, also mentioned as CVE-2026-93616.
- Conduct a comprehensive security audit of your VPN infrastructure to identify any other potential vulnerabilities.
- Ensure that your security policies require frequent patches and updates of all security software to mitigate risks associated with known vulnerabilities.
- Monitor network traffic for any suspicious activity that may indicate exploitation of the vulnerability.
2TI lens
When addressing network vulnerabilities in a post-2026 security landscape, a cohesive strategy across all network components is paramount. While Check Point's RCE flaw underscores the significance of immediate patching, a holistic approach would ensure that all relevant systems and the users who operate them are equally protected. Much as a well-orchestrated digital agency might design seamless network interactions, businesses must consider how their network infrastructure can be fortified beyond point solutions. When dealing with widespread vulnerabilities, integrating a PaaS approach ensures that the entire ecosystem is updated, monitored, and secured. This includes ensuring that patches are continuously applied without impacting productivity.Sources
Check Point, BleepingComputer, Wired, The Hacker News.
Check Point confirmed active exploitation of CVE-2026-85102, a critical vulnerability in its Security Gateway VPN. This finding has been reported by BleepingComputer.
The Hacker News further highlighted the risks of vulnerabilities in Check Point's systems, referring to past incidents including the exploit of a management server flaw. These instances illustrate broader system vulnerabilities.