Check Point confirms exploitation of a September VPN fix and discloses a zero-day in its management server

On 15 October 2026, Check Point confirms that CVE-2026-85102, a pre-authentication remote code execution flaw in its Security Gateway VPN fixed on 9 September, is now being exploited at scale against Spark firewalls, and ships a fix for a zero-day in its management server. Apply both hotfixes, starting with your management servers, which are watched less closely than the gateways.