Tia N.List

Reported by 4 outlets

Check Point warns of exploited Security Gateway VPN RCE (CVE-2026-85102)

hot0.0
Why this score
Breadth
2.00 / 2.0 · 4 sources
Authority
1.80 / 2.0 · best outlet weight
Severity
5.00 / 5.0 · CVSS + KEV signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.02 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
yazoul.netbleepingcomputer.comblog.checkpoint.comdeafnews.it CVE-2026-85102CVE-2026-93616 KEV desk first seen 18d ago

Desk analysis

Check Point warns that attackers are actively exploiting a critical remote code execution vulnerability in Security Gateway VPN appliances, tracked as CVE-2026-85102. The flaw allows unauthenticated remote attackers to execute arbitrary code. A second related vulnerability, CVE-2026-93616, is also flagged. Organizations using Check Point Security Gateway should apply patches immediately and review VPN access logs for suspicious connections.

Timeline

  1. original reporting

    🔵 THREAT INTELLIGENCE Check Point warns of hackers exploiting Security Gateway VPN RCE flaw Vulnerability | CRITICAL CVEs: CVE-2026-85102 Cy

    www.yazoul.net · 18d ago · September 25th, 2026

    🔵 THREAT INTELLIGENCE Check Point warns of hackers exploiting Security Gateway VPN RCE flaw Vulnerability | CRITICAL CVEs: CVE-2026-85102 Cy

    via Mastodon https://www.yazoul.net/news/article/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw

  2. update from yazoul.net

    Check Point Quantum VPN RCE exploited in the wild (CVE-2026-85102)

    yazoul.net · 35d ago · September 9th, 2026

    CVE advisory dated September 9, 2026, the day Check Point released fixes, describing an unauthenticated RCE on Quantum Security Gateways caused by improper certificate trust validation during VPN negotiation, CVSS 9.8, mapped to CWE-295 and ATT&CK T1557. Notes CISA KEV listing and EPSS 26th percentile (0.3% exploit probability), and cites the vendor advisory sk1000117.

  3. update from bleepingcomputer.com

    Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

    bleepingcomputer.com · 31d ago · September 12th, 2026

    Coverage of the Dutch NCSC warning, published September 12, 2026, that exploitation of CVE-2026-85102 and the related ASN.1 decoder heap overflow CVE-2026-85103 was imminent although no public PoC existed. Reports fixes issued September 9 in advisories sk1000117 and sk1000118, affected releases R81.20, R82, R82.10, R81.10.x and R82.00.x plus EoS R80 through R81.10, and LivePatch Take 24 with Jumbo Hotfix Takes 44, 126 and 166.

  4. update from blog.checkpoint.com

    Security Advisory - Action Required - Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616

    blog.checkpoint.com · 22d ago · September 22nd, 2026

    Vendor advisory by Check Point Research (Lotem Finkelstein) dated September 22, 2026 confirming a wave of exploitation attempts against Spark customers starting September 12, originating from VPN and proxy anonymization infrastructure and using certificates with subjects CN=vpn, OU=users, O=global and two close variants. Recommends hunting anomalous certificate-based Mobile Access logins followed by internal port and service scans, and confirms the management zero-day CVE-2026-93616 was used in pinpointed attacks on July 23, 2026.

  5. update from bleepingcomputer.com

    Check Point warns of hackers exploiting Security Gateway VPN RCE flaw

    bleepingcomputer.com · 20d ago · September 23rd, 2026

    First major news coverage, September 23, 2026, reporting Check Point's confirmation of in-the-wild exploitation of the pre-auth VPN certificate-handling RCE. Lists remediation detail: LivePatch Take 26 or Jumbo Hotfix R81.20 Take 166, R82 Take 126, R82.10 Take 44, R81.10 Take 190, Spark builds R82.00.10 Build 2325 and R81.10.17 Build 4968, verification via cpinfo -y CPupdates, UDP/500 and UDP/4500 restrictions, and the CISA KEV deadline of September 25, 2026 for federal agencies.

  6. update from deafnews.it

    Check Point confirms active attacks on CVE-2026-85102 began three days after patches dropped. CISA sets federal deadline of September 25. #

    deafnews.it · 16d ago · September 27th, 2026

    Check Point confirms active attacks on CVE-2026-85102 began three days after patches dropped.

  7. mentioned by blog.checkpoint.com

    From Check Point Research: Exploitation of CVE-2026-85102 and CVE-2026-93616 Check Point has observed active exploitation of two critical pr

    blog.checkpoint.com · 12d ago · October 1st, 2026

Source on GitHub