CVE Tools
Track your stack

Check Point warns of hackers exploiting Security Gateway VPN RCE flaw

BleepingComputerBy Bill Toulas

Reported exploitedSecurity GatewaySpark Firewall

Our summary

Check Point confirmed attackers are exploiting CVE-2026-85102, a pre-authentication RCE flaw in Security Gateway VPN certificate handling, and CVE-2026-93616, a pre-authentication path traversal issue in the Management web service that can enable script execution and Java class loading. Organizations should deploy the recommended LivePatch or Jumbo Hotfix updates for supported gateways and update Spark firewalls, while applying access-rule mitigations where patching is not possible.

Read at BleepingComputer

BleepingComputer publishes this story on its own site; we link to it rather than reprint it.

  1. Help Net SecurityWeek in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documentsCVE-2026-85102, CVE-2026-93616
  2. Help Net SecurityAttackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instancesCVE-2026-85102, CVE-2026-93616
  3. SecurityWeekCheck Point Patches Exploited Management Server Zero-DayCVE-2026-85102, CVE-2026-93616
  4. The Hacker NewsCheck Point Warns of Management Server Zero-Day Exploited in Targeted AttacksCVE-2026-85102, CVE-2026-93616
  5. BleepingComputerCheck Point warns of Management Server zero-day exploited in attacksCVE-2026-85102, CVE-2026-93616
  6. BleepingComputerInfraTrust report warns network management systems under attackCVE-2026-85102
  7. BleepingComputerNew Check Point flaw lets hackers execute code with root privilegesCVE-2026-85102
  8. The Hacker News⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and RootkitsCVE-2026-85102
  9. BleepingComputerDutch NCSC: Critical Check Point VPN flaws exploitation is imminentCVE-2026-85102
  10. SecurityWeekCheck Point Patches Critical VPN VulnerabilitiesCVE-2026-85102

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store