Cybersecurity company Check Point has confirmed that hackers are actively exploiting two vulnerabilities in its Security Gateway product, allowing attackers to execute code remotely and gain unauthorized access. The affected flaws, tracked as CVE-2026-85102 and CVE-2026-93616, impact the VPN certificate-handling functionality and Management web service, respectively.
The Dutch Nationaal Cyber Security Centrum (NCSC) had alerted users on September 10 that imminent exploitation of these vulnerabilities was expected, urging administrators to apply available security updates. However, Check Point has now confirmed that malicious activity began as early as September 12, with attackers using VPNs and proxies to hide their location.
Check Point’s advisory notes that the attacks originated from anonymization infrastructure, including VPN services and proxies. The company observed a wave of exploitation attempts against its Spark customers, with certificates bearing specific subjects being used in the attacks. However, it is unclear how many other malicious actors may be exploiting these vulnerabilities or what additional subjects they might use.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added both flaws to its Known Exploited Vulnerabilities catalog, urging federal agencies to apply available fixes by September 25. Check Point’s advisory recommends that administrators install a specific LivePatch Take on supported gateways or update Spark firewalls to a certain version.
In the absence of an immediate update, system administrators are advised to disable VPN implied rules and create explicit rules restricting Site-to-Site VPN traffic. For Remote Access VPN, administrators should allow only required services over specific ports and restrict source client IP ranges where possible.
While these mitigation measures may not apply to locally managed Spark firewalls, Check Point points users to a support article for additional guidance on the Management web service vulnerability. This incident serves as a reminder of the importance of timely security updates and proactive threat monitoring in preventing exploitation attempts.
For those who cannot update their systems immediately, restricting access to sensitive services is crucial to minimize potential damage. As we continue to navigate an increasingly complex cybersecurity landscape, it is essential for organizations to prioritize patch management and invest in robust incident response plans. By staying informed about emerging threats and vulnerabilities, administrators can better protect their networks from exploitation attempts.
Source: Bleeping Computer — 2026-09-23