Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE
Check Point patched two 9.8-rated VPN certificate flaws, CVE-2026-85102 and CVE-2026-85103, enabling unauthenticated remote code execution; no exploitation observed yet.
Check Point disclosed and began patching two critical (CVSS 9.8) vulnerabilities in VPN certificate handling on September 9: CVE-2026-85102, a certificate trust validation failure in VPN negotiation on Security Gateways, and CVE-2026-85103, a heap-based buffer overflow in ASN.1 decoding affecting Quantum Security Gateways and Security Management Server. Affected branches include R81.20, R82, and R82.10 Jumbo Hotfix levels; fixes ship via Live Patch or the latest Jumbo Hotfix. The company found both internally and reports no evidence of exploitation; the Canadian Centre for Cyber Security also published an advisory listing Spark firewalls.
- CVE-2026-85102: certificate trust validation failure during VPN negotiation
- CVE-2026-85103: heap buffer overflow in ASN.1 certificate decoding
- CVSS 9.8, unauthenticated remote attacker may execute code
- Fixes via Check Point Live Patch or latest Jumbo Hotfix Take
- No indicators of compromise; no observed exploitation reported
- Vendors
- Check Point
- Organizations
- CISACanadian Centre for Cyber Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-16232 | Authentication Bypass in Check Point SmartConsole Grants Full Admin Access | 9.3 | 4% | KEV | KEV |
| CVE-2026-50751 | Unauthenticated IKEv1 VPN Auth Bypass in Check Point Security Gateways | 9.3 | 85% | KEVRansomwarePoC | KEV |
| CVE-2026-85102 | Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw | 9.8 | 54% | KEVPoC | KEV |
| CVE-2026-85103 | Unauthenticated RCE in Check Point Quantum VPN Certificate ASN.1 Decoding | 9.8 | — |
From the original article
4 min read at thehackernews.com
Check Point has patched two critical vulnerabilities in the way its firewall and management products handle VPN certificates. The company says both could allow an unauthenticated remote attacker to run code, but only "under specific conditions" that it has not described. One flaw affects Check Point's Security Gateways, its firewall appliances.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.