Critical Check Point VPN Vulnerabilities Enable Remote Code Execution Attacks
Check Point patched two critical VPN flaws, CVE-2026-85102 and CVE-2026-85103 (CVSS 9.8), allowing unauthenticated RCE on Security Gateways.
Check Point disclosed and patched two critical VPN vulnerabilities, CVE-2026-85102 (improper certificate trust validation, CWE-295) and CVE-2026-85103 (heap-based buffer overflow in ASN.1 certificate parsing, CWE-122), both rated CVSS 9.8 and exploitable for unauthenticated remote code execution under specific conditions. The flaws affect Security Gateway, Security Management Server, and Spark Firewall deployments on R81.20, R82, and R82.10 branches plus end-of-support versions such as R80.40 and R81, while R82.20 is not affected. Check Point reports no evidence of active exploitation or public PoC; Live Patch rollout began September 9, 2026, and administrators without it must install Jumbo Hotfix Accumulator builds (R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+). For Site-to-Site VPN, restricting UDP ports 500 and 4500 to known peers serves as an interim workaround, but no mitigation exists for Remote Access VPN or Spark Firewalls.
- CVE-2026-85102 stems from improper certificate trust validation (CWE-295) during VPN negotiation, enabling unauthenticated RCE.
- CVE-2026-85103 is a heap-based buffer overflow (CWE-122) triggered by malicious certificates on gateways and management servers.
- No evidence of exploitation or public PoC; flaws are unrelated to the actively exploited IKEv1 bypass CVE-2026-50751.
- Live Patch users received protection automatically from September 9, 2026; others need manual hotfixes.
- Vendors
- Check Point
- Organizations
- Check Point
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50751 | Unauthenticated IKEv1 VPN Auth Bypass in Check Point Security Gateways | 9.3 | 85% | KEVRansomwarePoC | KEV |
| CVE-2026-85102 | Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw | 9.8 | 54% | KEVPoC | KEV |
| CVE-2026-85103 | Unauthenticated RCE in Check Point Quantum VPN Certificate ASN.1 Decoding | 9.8 | — |
From the original article
2 min read at cybersecuritynews.com
Check Point Software has disclosed and patched two critical VPN-related vulnerabilities, CVE-2026-85102 and CVE-2026-85103, both carrying a maximum CVSS score of 9. 8 and both capable of allowing unauthenticated remote code execution under specific conditions. Check Point’s own research team uncovered the flaws, and the company says it has found no evidence of active exploitation or […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.