Critical Check Point VPN Flaws Let Unauthenticated Attackers Execute Remote Code
Check Point fixed critical unauthenticated RCE flaws CVE-2026-85102 and CVE-2026-85103 in its VPN gateways; no exploitation observed yet.
Check Point disclosed two critical vulnerabilities affecting Remote Access VPN and Site-to-Site VPN on its security gateways. CVE-2026-85102 is an authentication-bypass flaw that can lead to unauthenticated remote code execution, while CVE-2026-85103 is a heap overflow in ASN.1 decoding that can corrupt memory and also result in RCE. Fixes are available via Jumbo Hotfix, with Check Point Live Patch rollout starting September 9, 2026; the vendor found and fixed the issues through internal research and reports no evidence of exploitation in the wild.
- CVE-2026-85102 is an authentication-bypass flaw enabling unauthenticated remote code execution
- CVE-2026-85103 is a heap overflow in ASN.1 decoding, also leading to RCE
- Both flaws affect Remote Access VPN and Site-to-Site VPN on security gateways
- Fixes shipped via Jumbo Hotfix; Live Patch rollout began September 9, 2026
- No exploitation observed, but internet-exposed VPN gateways are high-value targets
- Vendors
- Check Point
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85102 | Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw | 9.8 | 54% | KEVPoC | KEV |
| CVE-2026-85103 | Unauthenticated RCE in Check Point Quantum VPN Certificate ASN.1 Decoding | 9.8 | — |
From the original article
2 min read at gbhackers.com
Check Point has announced two critical vulnerabilities in its VPN technology that could allow unauthenticated remote attackers to execute arbitrary code on affected security gateways under certain conditions. These vulnerabilities, tracked as CVE-2026-85102 and CVE-2026-85103, impact both Remote Access VPN and Site-to-Site VPN functionalities.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.