Loading story…
Check Point VPN products are affected by critical vulnerabilities CVE-2026-85102 and CVE-2026-85103 that can be exploited remotely without credentials to bypass security controls and execute attacker-controlled code. CVE-2026-85102, rated CVSS 9.8, results from improper validation of certificate data during VPN negotiation in certificate-authenticated VPN functionality; exploitation against Spark Firewalls has been observed since September 12. A successful attack can fully compromise an affected gateway, expose or alter sensitive information, and disrupt services.
Affected deployments include Security Gateway and Spark Firewall Remote Access and Site-to-Site VPN configurations using certificate authentication, including DAIP and LSV setups where it may be implicitly enabled. Pre-Shared Key-only VPN configurations and version R82.20 are not affected. Check Point has released LivePatch and Jumbo Hotfix Accumulator remediation options, and the NCSC recommends immediate patching; organizations using Site-to-Site VPN should also disable implied rules and restrict VPN access to specified IP addresses.
See which actors are running it and whether you're in range.
2 events from the most recent confirmed update back to the earliest known activity.
Check Point's advisory states that CVE-2026-85102 had been actively exploited against Spark Firewall devices since this date. The flaw can enable unauthenticated remote code execution through certificate-authenticated VPN functionality.
Check Point published advisory sk1000117 for CVE-2026-85102, a CVSS 9.8 certificate-validation flaw in Security Gateway and Spark Firewall VPN functionality. The advisory identified affected certificate-authenticated Remote Access and Site-to-Site VPN deployments and provided LivePatch, Jumbo Hotfix, and Spark Firewall build remediation options.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point issued emergency updates for two critical vulnerabilities, **CVE-2026-85102** and **CVE-2026-85103**, affecting Quantum Security Gateways, Security Management systems, Spark Firewalls, and Remote Access and Site-to-Site VPN deployments. An unauthenticated attacker could exploit flaws in certificate handling during VPN negotiation to execute arbitrary code on exposed perimeter appliances; CVE-2026-85102 involves improper certificate validation and authentication bypass, while CVE-2026-85103 is a heap overflow in ASN.1 certificate decoding. Check Point has provided fixes through LivePatch and Jumbo Hotfix Accumulator packages. Organizations should apply available updates promptly and, where patching is delayed, reduce VPN exposure using implied-rule and UDP-port controls. No public proof-of-concept exploit was reported at disclosure, but internet-facing VPN infrastructure is a high-priority remediation target.
Sep 15, 2026
Check Point disclosed and patched **`CVE-2024-24919`**, a critical information disclosure flaw affecting Internet-connected **Network Security Gateway** devices with **Remote Access VPN** or **Mobile Access** enabled. The vulnerability was traced to improper HTTP `POST` request validation that can enable directory traversal and arbitrary file reads by an unauthenticated attacker, allowing exposure of sensitive data from affected gateways. Check Point said it observed exploitation attempts in the wild, issued an initial mitigation, then released a mandatory hotfix and urged customers to apply it immediately. Reported abuse focused on remote-access environments, particularly older local VPN accounts using password-only authentication. Stolen data may include local account password hashes, private SSH keys, certificates, and potentially Active Directory-related files such as `ntds.dit`, creating follow-on risk of credential theft, lateral movement, broader network intrusion, and possible escalation toward remote code execution. Check Point and external responders advised organizations to disable unused local accounts, enforce stronger authentication such as MFA or certificates, rotate exposed credentials, and review gateway and authentication logs for signs of compromise.
Jul 24, 2026
Check Point released security updates to fix multiple vulnerabilities across **Mobile Access**, **SSL VPN**, **Remote Access VPN**, **Spark Firewall**, **Security Gateways**, and **Multi-Domain Security Management**. The most severe flaw, **`CVE-2026-50751`** with a **CVSS 9.3**, is an authentication bypass issue in deprecated **IKEv1** key exchange used for VPN Remote Access and Mobile Access, and Check Point said it is being exploited in the wild as a **zero-day**. The update also addresses **`CVE-2026-50752`**, which affects certificate validation in deprecated **IKEv1** site-to-site VPN connections and could allow **man-in-the-middle** attacks. Across the broader set of flaws, Check Point warned of risks including **denial of service, data manipulation, authentication bypass, and unauthorized access**, and urged organizations to apply patches as soon as testing is complete.
Jul 10, 2026