Critical Check Point VPN Vulnerabilities Allow RCE Attacks

Key Takeaways

• Check Point has released patches for two critical VPN vulnerabilities, CVE-2026-85102 and CVE-2026-85103.
• Both flaws carry a CVSS score of 9.8 and could enable unauthenticated remote code execution.
• The vulnerabilities affect various Check Point Security Gateway, Security Management Server, and Spark Firewall versions.
• While no active exploitation has been detected, immediate patching is strongly recommended.

Check Point Software has addressed two severe vulnerabilities within its VPN products, identified as CVE-2026-85102 and CVE-2026-85103. Both security flaws have been assigned a maximum CVSS score of 9.8, indicating their critical nature, and possess the potential for unauthenticated remote code execution under specific circumstances.

The company’s internal research team discovered these issues. As of this report, Check Point states there is no evidence of these vulnerabilities being actively exploited in the wild, nor has any public proof-of-concept code been released.

Check Point VPN Vulnerabilities Detailed

CVE-2026-85102: Improper Certificate Trust Validation

This vulnerability stems from a deficiency in how VPN connections validate certificate trust, categorized under CWE-295. According to Check Point’s advisory sk1000117, the system fails to adequately verify the authenticity of a presented certificate during VPN negotiation. This allows an attacker, without prior authentication, to advance the VPN negotiation process sufficiently to execute arbitrary code on the Security Gateway. Both Remote Access VPN and Site-to-Site VPN configurations are susceptible to this flaw.

CVE-2026-85103: Heap-Based Buffer Overflow

In contrast, CVE-2026-85103 is a heap-based buffer overflow, classified as CWE-122. This vulnerability occurs when the product processes the ASN.1 structure of a VPN certificate. As detailed in advisory sk1000118, a remote attacker can trigger this overflow by sending a specially crafted malicious certificate. This could lead to code execution on both Quantum Security Gateway and Quantum Security Management systems.

These vulnerabilities impact a range of Check Point deployments, including Security Gateway, Security Management Server, and Spark Firewall, across several release branches. Affected versions include R81.20, R82, and R82.10 with Jumbo Hotfix Takes below the recently patched builds. Several end-of-support versions, such as R80.40 and R81, are also vulnerable. Check Point has confirmed that R82.20 is not affected by these issues.

It is important to note the scope difference: CVE-2026-85102 primarily affects Security Gateways involved in VPN connections, whereas CVE-2026-85103 has a broader impact, extending to both gateway and management infrastructure components.

For organizations using Check Point Live Patch, protection against these vulnerabilities was automatically rolled out starting September 9, 2026. However, administrators who do not have Live Patch enabled must manually install the latest Jumbo Hotfix Accumulator for their specific branch. This includes R82.10 Take 44 or higher, R82 Take 126 or higher, or R81.20 Take 166 or higher, in addition to dedicated Spark Firewall builds.

For Site-to-Site VPN deployments unable to apply patches immediately, Check Point suggests a temporary mitigation: disabling implied VPN rules and restricting UDP ports 500 and 4500 to only known peer IP addresses. This workaround, however, is not applicable to Remote Access VPNs, and no interim mitigation is available for locally managed Spark Firewalls.

It is crucial to distinguish these newly disclosed vulnerabilities from CVE-2026-50751, an IKEv1 authentication bypass linked to Qilin ransomware activity that was disclosed and actively exploited earlier this year.

What You Should Do

• Prioritize Patching: Given the critical severity and network-exploitable nature of both flaws, security teams managing Check Point infrastructure should apply the necessary patches immediately. Do not wait for confirmed in-the-wild exploitation.
• Verify Live Patch Status: If you utilize Check Point Live Patch, confirm that the automatic updates were successfully applied.
• Manual Updates: For systems without Live Patch, download and install the latest Jumbo Hotfix Accumulator appropriate for your specific product branch and version (e.g., R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+).
• Apply Workarounds (Site-to-Site VPN Only): If immediate patching for Site-to-Site VPN is not feasible, implement the recommended workarounds: disable implied VPN rules and restrict UDP ports 500 and 4500 to known peer IP addresses. Be aware that this does not mitigate risks for Remote Access VPN or locally managed Spark Firewalls.
• Stay Informed: Continue monitoring Check Point advisories and security news for any further updates or emerging threats.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.