<![CDATA[Check Point warns of hackers exploiting Security Gateway VPN RCE flaw]]>Check Point has confirmed that attackers are actively exploiting a critical vulnerability in its Security Gateway product. The flaw, tracked as CVE-2026-85102, is a pre-authentication remote code execution (RCE) issue that resides in the VPN certificate-handling functionality of the product. Because exploitation occurs before authentication, an attacker does not need valid credentials to trigger the vulnerability.

According to the company's warning, the flaw is being used in real-world attacks, making prompt patching essential for any organization running an affected Security Gateway deployment exposed to VPN traffic.

Administrators should take the following steps:

  • Apply the vendor-provided fix for CVE-2026-85102 as soon as possible.
  • Review VPN and Security Gateway logs for unusual certificate-related activity or unexpected connections.
  • Restrict or monitor external access to VPN endpoints where feasible until patching is complete.
  • Monitor Check Point's official advisory and communications for updated guidance.

Given that this is a pre-auth RCE in an internet-facing VPN component, the risk is significant. Organizations that have not yet patched should treat this as urgent.

Source: BleepingComputer

Has your organization already applied the fix for CVE-2026-85102, or are you still assessing exposure on your Security Gateway VPN endpoints?

]]>https://xploitlk.com/topic/441/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flawRSS for NodeTue, 27 Oct 2026 11:01:10 GMTWed, 23 Sep 2026 20:30:24 GMT60