Check Point has confirmed active exploitation of CVE-2026-85102, a critical vulnerability affecting VPN certificate handling in Check Point Security Gateway and Spark Firewall products. The flaw can allow a remote, unauthenticated attacker to bypass authentication and execute code on affected gateways under vulnerable VPN configurations.
What happened
Check Point originally released fixes for CVE-2026-85102 on September 9, 2026. At that time, the company said it had no evidence that the vulnerability was being exploited. Check Point has since updated its guidance and says it observed a wave of exploitation attempts against Spark customers beginning September 12.
On September 22, the U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-85102 to its Known Exploited Vulnerabilities catalog. CISA’s action reflects evidence that the vulnerability is being used in real-world attacks.
What is confirmed
CVE-2026-85102 is a pre-authentication vulnerability involving improper validation of certificate data during VPN negotiation. Check Point and independent reporting confirm that exploitation attempts are occurring in the wild. Check Point says observed attempts have originated through anonymization infrastructure, including VPN services and proxies.
The issue affects Check Point Security Gateway and Spark Firewall deployments using Site-to-Site VPN or Remote Access VPN. Check Point has released LivePatch, Jumbo Hotfix, and updated Spark builds for affected supported releases.
What remains unknown
Public information does not establish the full number of organizations successfully compromised through CVE-2026-85102, the identity of all attackers involved, or the complete scope of post-exploitation activity. Reports of exploitation attempts should therefore not be interpreted as proof that every targeted system was compromised.
Who is affected
Organizations using Check Point Security Gateway or Spark Firewall should determine whether they run an affected release and whether Site-to-Site VPN or Remote Access VPN is enabled. Check Point’s current advisory lists fixes across supported R81.20, R82, and R82.10 gateway releases as well as updated Spark firewall builds. Administrators should use Check Point’s current product guidance rather than relying only on a version number from a secondary source.
Why this matters to small businesses
VPN gateways sit at the edge of a business network and are designed to accept connections from outside the organization. A vulnerability that can be reached before authentication is especially important because an attacker may not need a stolen employee password to begin an attack.
Small businesses may also be affected indirectly when a managed service provider, IT contractor, or security provider operates Check Point equipment on their behalf. Businesses that outsource firewall management should ask their provider to confirm whether affected Check Point products are in use and whether the applicable fix has been installed.
What businesses should do now
Verify the patch level. Check Point recommends LivePatch Take 26 on supported gateways or the applicable fixed Jumbo Hotfix. Spark customers should install a fixed build identified in the vendor advisory. Administrators should confirm the installed protection rather than assuming automatic updates completed successfully.
Review VPN exposure. If immediate updating is not possible, Check Point recommends restricting VPN traffic to required peers and source ranges where the environment allows it. Organizations should avoid exposing services that are not operationally necessary.
Check for suspicious activity. Review VPN, authentication, firewall, and endpoint telemetry for unusual access or internal scanning. Check Point has published observed certificate subjects and other hunting guidance, but the vendor cautions that current indicators are not exhaustive.
Ask managed providers for evidence. Businesses using an MSP or outside IT provider should request confirmation of the affected product version, remediation applied, date installed, and any review performed for signs of exploitation.
A second Check Point flaw also requires attention
Check Point has separately disclosed active exploitation of CVE-2026-93616, a critical pre-authentication vulnerability affecting Security Management Server and related management products. That flaw can allow arbitrary script execution and requires its own security updates. Organizations running Check Point management infrastructure should review both advisories because remediation for one vulnerability does not necessarily protect against the other.
Sources
Check Point: Security Advisory on CVE-2026-85102 and CVE-2026-93616
CISA: Known Exploited Vulnerabilities update
BleepingComputer: Check Point confirms Security Gateway VPN RCE exploitation
SecurityWeek: Check Point exploited vulnerabilities and fixes