Check Point VPN Flaw Actively Exploited

Check Point confirms hackers are exploiting CVE-2026-85102, a pre-authentication RCE in Security Gateway VPN certificate handling, with attacks starting September 12 from anonymization infrastructure. A second flaw, CVE-2026-93616, has been exploited as a zero-day since July 23. CISA added both to its Known Exploited Vulnerabilities catalog, ordering federal agencies to patch by September 25.