Check Point Confirms Active Exploitation of Critical VPN RCE Flaw in Security Gateway

Cybersecurity firm Check Point has warned that threat actors are actively exploiting a severe pre‑authentication remote code execution vulnerability, identified as CVE‑2026‑85102, in the VPN certificate‑handling component of its Security Gateway product.

The flaw allows unauthenticated attackers to execute arbitrary code on affected gateways by sending specially crafted packets during the TLS handshake. Because the vulnerability is triggered before any user credentials are verified, it bypasses typical access controls and can give an adversary full control over the gateway, potentially exposing internal networks and data.

Check Point’s security advisory notes that the vulnerability was first reported by BleepingComputer, and the vendor has observed evidence of exploitation in the wild. While the company has not disclosed specific incidents, it advises that the attacks appear to be targeted and may be leveraged by sophisticated groups seeking to establish footholds within corporate environments that rely on Check Point’s VPN solution.

The issue stems from improper validation of certificate data processed by the Security Gateway’s VPN module. Similar pre‑authentication flaws have surfaced in other VPN products in recent years, highlighting the broader risk posed by remote access infrastructure when attackers can bypass authentication entirely. Industry analysts note that such vulnerabilities are especially attractive to threat actors because they can be used to infiltrate networks without needing stolen credentials.

Check Point recommends that customers apply the emergency patch released in the latest firmware update, enable strict certificate validation, and review firewall and intrusion‑prevention policies for signs of anomalous traffic. The vendor also urges organizations to monitor logs for unusual connection attempts and to employ multi‑factor authentication for any subsequent access to critical systems.

Experts say the emergence of CVE‑2026‑85102 underscores the importance of timely patch management and continuous monitoring of security appliances. As remote work remains prevalent, the reliance on VPN solutions continues to grow, making any weakness in these gateways a high‑value target. The cybersecurity community will be watching how quickly organizations respond to Check Point’s advisory and whether further disclosures about the exploit’s scope emerge.