Security Gateway flaws enter reported active-exploitation phase
SecurityUnverifiedUpdated:
Security Gateway vulnerabilities have moved from a warning of imminent exploitation to reported active attack attempts. The underlying claims have not been independently verified.
Pre-authentication VPN and management functions affected
BleepingComputer reports that Check Point confirmed active exploitation of CVE-2026-85102, a pre-authentication remote-code-execution flaw in Security Gateway VPN certificate handling.
The report also says attackers have exploited CVE-2026-93616, a pre-authentication path-traversal flaw in the Management web service that can enable script execution and Java class loading. According to the article, CISA added both flaws to its Known Exploited Vulnerabilities catalog.
On September 10, the Dutch NCSC had warned that exploitation of the Security Gateway issue was imminent and urged users to apply available updates.
The situation has shifted from an expected exploitation risk to reported observations of exploitation attempts, including activity against Spark customers beginning September 12.
Some earlier LivePatch installations need newer coverage
The reported activity concerns vulnerabilities accessible before authentication, affecting VPN and management-facing Security Gateway functions. The article says fixes and mitigations are available, while noting that some earlier offline LivePatch installations require a newer package for full coverage.
Sources
- BleepingComputerCheck Point warns of hackers exploiting Security Gateway VPN RCE flawRead source →