CVE-2026-85102 in Check Point VPN gateway exploited pre-auth

Key points

• A Check Point gateway bug involves how VPN certificates are handled.
• Attackers can run code remotely without first authenticating.
• The vendor has confirmed that exploitation is already happening.
• The number of affected organizations has not been disclosed.
• Immediate patching or mitigation is required.

Check Point has issued a warning about a high-severity vulnerability tracked as CVE-2026-85102. The issue sits in the way its Security Gateway product processes VPN certificates. According to the vendor, unknown threat actors are already taking advantage of the bug. Because the flaw can be triggered before a user logs in, an attacker could run arbitrary code on an exposed gateway without valid credentials.

The affected population includes any organization that exposes a Check Point Security Gateway with VPN certificate functionality to the internet. That likely covers many school districts, government agencies, and service providers that rely on remote-access VPNs. The exact number of vulnerable or compromised deployments remains undisclosed, so defenders should assume their own perimeter may be targeted.

Why this matters: a pre-auth code execution path on an internet-facing security appliance is among the most dangerous bug classes. It can let intruders bypass authentication, gain a foothold, and then move laterally into internal networks. Once inside, attackers could steal data, deploy ransomware, or disable security controls. Active exploitation raises the urgency from a routine patch cycle to an emergency response.

Check Point has confirmed that attacks are underway, but details about the attackers and their methods are limited. VPN certificate handling flaws often stem from parsing or validation errors, and they can be difficult to detect without detailed logs. Administrators should treat any unexpected certificate errors or gateway crashes as potential indicators.

What to watch: vendor advisories and hotfixes, threat intelligence feeds for CVE-2026-85102, and signs of compromise on gateways. Look for unusual processes, outbound connections, new accounts, or configuration changes. Until a fix is applied, reduce exposure by limiting VPN access and monitoring authentication and certificate events closely.

What to do now

1. Apply the vendor's patch or hotfix for CVE-2026-85102 on every affected gateway immediately.
2. If no patch is available, disable or restrict VPN certificate-based authentication and limit remote access to trusted IP ranges.
3. Review gateway, VPN, and certificate logs for exploitation attempts, unusual errors, or unexpected process creation.
4. Rotate VPN certificates, credentials, and secrets on any gateway that may have been exposed.
5. Segment the gateway from internal networks and enforce least privilege to limit lateral movement.
6. Enable multi-factor authentication and restrict management interfaces to trusted administrative networks.
7. Subscribe to Check Point advisories and threat intel updates for new indicators or mitigations.

CVE references

• CVE-2026-85102

Original source

BleepingComputer