35
55
30
30
35
30
35
Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE
Check Point patched two 9.8-rated VPN certificate flaws, CVE-2026-85102 and CVE-2026-85103, enabling unauthenticated remote code execution; no exploitation observed yet.
Check Point disclosed and began patching two critical (CVSS 9.8) vulnerabilities in VPN certificate handling on September 9: CVE-2026-85102, a certificate trust validation failure in VPN negotiation on Security Gateways, and CVE-2026-85103, a heap-based buffer overflow in ASN.1 decoding affecting Quantum Security Gateways and Security Management Server. Affected branches include R81.20, R82, and R82.10 Jumbo Hotfix levels; fixes ship via Live Patch or the latest Jumbo Hotfix. The company found both internally and reports no evidence of exploitation; the Canadian Centre for Cyber Security also published an advisory listing Spark firewalls.
62
30
35
60
55
30
55
42
30
42
55
60
60
47
42
60
30
30
30
35
55
60
55
30
47
30
35
42
42
30
35
42
30