The gap between "patched" and "exploited" is usually where the real risk in any vulnerability disclosure sits, and CVE-2026-85102 is a clean illustration of how fast that gap can close. Check Point's own advisory, detailed on the Check Point blog, disclosed the flaw and shipped fixes on 9 September with no evidence of exploitation at the time. That held for exactly three days.
What changed on 12 September
Per Check Point's own account and BleepingComputer's reporting, a wave of exploitation attempts against Spark customers began on 12 September, sourced from anonymisation infrastructure including VPN services and commercial proxies. The attackers weren't guessing at credentials - they were presenting certificates carrying specific subject fields, such as CN=vpn,OU=users,O=global, that the vulnerable certificate-handling logic in Security Gateway's VPN component accepted well enough to grant unauthenticated remote code execution. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 22 September, with the standard three-day remediation clock running out for federal agencies on 25 September.
A second flaw makes patching the gateway only half the job
Truesec's analysis pairs CVE-2026-85102 with CVE-2026-93616, a separate pre-authentication vulnerability affecting Check Point's Security Management product. The two were disclosed together, and an organisation that patches its internet-facing Security Gateway appliances but leaves the management layer on the old build has closed the door attackers are actively using while leaving open one they haven't started using in volume yet - a distinction that matters for patch sequencing under deadline pressure, not just for the headline CVE.
Nine days of exposure that nobody could see coming
What makes this timeline worth sitting with isn't that Check Point was slow - a nine-day gap between a clean patch and confirmed exploitation is, if anything, a fast attacker response by 2026 standards. It's that "patched with no evidence of exploitation" is a snapshot, not a guarantee, and organisations that read Check Point's 9 September advisory and deprioritised the update because nothing was happening yet were, within three days, wrong to have done so.
- Patch Security Gateway against CVE-2026-85102 now if you haven't - "no evidence of exploitation at disclosure" bought this flaw nine days, not immunity.
- Patch Security Management against CVE-2026-93616 in the same pass - treating the paired disclosure as one job, not two, closes the door attackers haven't reached yet before they do.
- Audit VPN gateway logs for connections originating from known anonymisation or commercial proxy infrastructure, and for certificates presenting the subject pattern Check Point has published.
- Build "no evidence yet" into your own patch prioritisation as a temporary state rather than a green light - a CVSS 9.8 pre-auth RCE on an internet-facing VPN gateway earns urgent remediation on severity alone.
Nine days is roughly how long the gap lasted between a clean disclosure and attackers using it against real customers. That's not a comfortable margin to plan a patch cycle around. Email sales@halfteck.com if you'd like help auditing your perimeter appliance patch cadence against this year's run of VPN and firewall zero-days.