CTI · reviewed · 2026-09-27

Check Point warns of exploited Security Gateway VPN RCE (CVE-2026-85102)

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1557 Adversary-in-the-Middle Credential Access
• T1649 Steal or Forge Authentication Certificates Credential Access
• T1046 Network Service Discovery Discovery

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Check Point VPN Certificate Subject Anomaly - CN=vpn OU=users O=global
id: 0a8ab186-4720-48c9-9477-6eda39cf4cd3
status: experimental
description: Detects certificate-based VPN / Mobile Access authentications presenting client certificates with the subject pattern observed in CVE-2026-85102 exploitation (CN=vpn, OU=users, O=global and close variants), the hunt Check Point prescribed for the September 2026 exploitation wave against Spark customers starting September 12 from VPN and proxy anonymization infrastructure.
references:
  - https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
  - https://www.bleepingcomputer.com/news/security/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw/
author: Tia N. List
date: 2026-09-27
tags:
  - attack.t1190
  - attack.t1557
  - attack.t1649
logsource:
  category: authentication
detection:
  selection_cert_subject:
    certificate_subject|contains|all:
      - 'CN=vpn'
      - 'OU=users'
      - 'O=global'
  condition: selection_cert_subject
falsepositives:
  - Client certificates legitimately issued with similar CN/OU/O attributes
  - Red-team or security-testing certificates created from permissive templates
level: high

References

• https://www.yazoul.net/news/article/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw
• https://www.yazoul.net/advisory/cve/cve-2026-85102-check-point-quantum-vpn-rce-exploited-in-the-wild/
• https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/
• https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
• https://www.bleepingcomputer.com/news/security/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw/