Check Point warns of hackers exploiting Security Gateway VPN RCE flaw

Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution vulnerability affecting the VPN certificate-handling functionality in its Security Gateway product. The flaw allows unauthenticated attackers to execute arbitrary code remotely, making it particularly dangerous. Active exploitation in the wild has been observed, prompting Check Point to issue an urgent warning to its customers. Organizations using Check Point Security Gateway with VPN functionality are advised to apply patches or mitigations immediately. The vulnerability's pre-authentication nature significantly raises its severity and exploitation risk.