Check Point Security Gateway VPN and Management Web Service Active Exploitation

Affected Environment
Check Point Security Gateway, Spark Firewall, and Security Management Server across R80 through R82.20 branches.

Threat Overview
Improper certificate validation in VPN negotiation and a path traversal flaw enable unauthenticated remote code execution.

Exposure Timeline
Exploitation against Spark customers began 12 September 2026; the management web service flaw is also actively exploited.

Attack Surface
Site-to-Site and Remote Access VPN certificate authentication, and the management web service's TCP/19009 endpoint.

Technical Root Cause
Improper validation of certificate data during VPN negotiation, and directory traversal enabling arbitrary script upload.

Exploitation Pathway
Attacker presents a crafted VPN certificate or uploads a malicious script via path traversal to execute code.