Check Point has confirmed active exploitation of CVE-2026-85102, a critical pre-authentication remote code execution vulnerability in Security Gateway VPN certificate handling. A fix has been available since September 9, 2026.
What happened
In its September 22 advisory, Check Point reported exploitation attempts against Spark customers beginning September 12. The vulnerability carries a CVSS score of 9.8. The company separately reported targeted exploitation of CVE-2026-93616, a pre-authentication path traversal vulnerability in Security Management, with a fix available when the advisory was published.
These are distinct issues: the VPN attacks followed the availability of a fix; the management vulnerability was a zero-day. Their affected products and remediation requirements differ. See Check Point’s primary advisory and its linked product-specific instructions.
Why it matters
A remote-access service is part of a business’s security boundary. When it is compromised, the immediate concern extends beyond service availability to the systems and information reachable through it. The impact depends on the deployed configuration, permissions and network controls; it should not be assumed that every installation has been compromised.
For operations teams, the practical challenge is connecting vulnerability information to an accurate inventory: which devices are affected, which fixes are installed, who owns the remediation, and what evidence supports completion.
What to do
- Identify affected installations and apply the vendor-prescribed fix for each deployed version.
- Review the vendor’s investigation guidance alongside patching; installing a fix is not evidence that a previously exposed system was never compromised.
- Document the change, validation results and any findings requiring incident-response follow-up.
The 2TI perspective
Centralized inventory, clear ownership and tracked maintenance can make this work easier to coordinate. Automation can help collect status and flag incomplete tasks, while people remain responsible for assessing exposure and verifying the result. No platform architecture alone guarantees security or interruption-free patching.