Check Point warns of hackers exploiting Security Gateway VPN RCE flaw
-
Check Point has confirmed that attackers are actively exploiting a critical vulnerability in its Security Gateway product. The flaw, tracked as CVE-2026-85102, is a pre-authentication remote code execution (RCE) issue that resides in the VPN certificate-handling functionality of the product. Because exploitation occurs before authentication, an attacker does not need valid credentials to trigger the vulnerability.
According to the company's warning, the flaw is being used in real-world attacks, making prompt patching essential for any organization running an affected Security Gateway deployment exposed to VPN traffic.
Administrators should take the following steps:
- Apply the vendor-provided fix for CVE-2026-85102 as soon as possible.
- Review VPN and Security Gateway logs for unusual certificate-related activity or unexpected connections.
- Restrict or monitor external access to VPN endpoints where feasible until patching is complete.
- Monitor Check Point's official advisory and communications for updated guidance.
Given that this is a pre-auth RCE in an internet-facing VPN component, the risk is significant. Organizations that have not yet patched should treat this as urgent.
Source: BleepingComputer
Has your organization already applied the fix for CVE-2026-85102, or are you still assessing exposure on your Security Gateway VPN endpoints?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login