Check Point VPN CVE-2026-85102 (CVSS 9.8) now exploited — CISA KEV; LivePatch Take 26 / Jumbo takes
UPDATE 23–24 Sep 2026: Check Point blog advisory and BleepingComputer confirm active exploitation of CVE-2026-85102 (pre-auth RCE in Security Gateway / Spark VPN certificate handling) beginning 12 September 2026 against Spark customers (anonymized VPN/proxy infra; observed cert subjects include CN=vpn / CN=vpn-user / CN=vpnuser under OU=users,O=global — list not exhaustive). CISA added CVE-2026-85102 to KEV on 22 Sep 2026 (due 25 Sep).
Vendor disclosed + shipped fixes 9 Sep with no then-known exploitation; Dutch NCSC 12 Sep had assessed exploitation as imminent. Remediation: LivePatch Take 26 on supported R81.20/R82/R82.10 gateways, or Jumbo R81.20 Take 166 / R82 Take 126 / R82.10 Take 44 / R81.10 Take 190 or later; Spark R82.00.10 Build 2325 or R81.10.17 Build 4968+.
Same advisory wave also covers Management CVE-2026-93616 (separate desk card; KEV 22 Sep). Primary: Check Point sk1000117; vendor blog 23 Sep; wire: BleepingComputer 23 Sep 2026.
- Product
- Check Point Quantum Security Gateway / Spark Firewall (Site-to-Site or Remote Access VPN certificate handling); related Management issue tracked separately as CVE-2026-93616
- Versions
- Apply LivePatch Take 26 (R81.20/R82/R82.10) or Jumbo Hotfix ≥ R81.20 Take 166 / R82 Take 126 / R82.10 Take 44 / R81.10 Take 190; Spark ≥ R82.00.10 Build 2325 or R81.10.17 Build 4968. Confirm exact trains on sk1000117. CVE-2026-85103 (ASN.1 heap overflow; sk1000118) remains sibling Critical VPN-cert issue — patch per SK.
- CVSS
- (CVE-2026-85102 CVSS 3.1 Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Exploited in Australia?
- unknown
- Patch to
- Install LivePatch Take 26 or matching Jumbo/Spark builds per sk1000117 immediately; hunt Mobile Access logs for anomalous certificate logins (not only CN=vpn*); review second-stage scans from suspicious VPN users; also patch Management CVE-2026-93616 via sk1000171 (LivePatch 28/29 does NOT fix 93616)