Hackers actively exploiting critical Check Point Security Gateway VPN vulnerabilities

Check Point confirmed that attackers are actively exploiting CVE-2026-85102, a pre-authentication remote code execution vulnerability in the VPN certificate-handling functionality of its Security Gateway product. The company also reported exploitation of CVE-2026-93616, a pre-authentication path traversal vulnerability in the Management web service, as a zero-day since July 23.