Check Point has released emergency security updates for two critical vulnerabilities affecting its Security Gateway, Security Management and Spark Firewall products, warning that attackers could potentially exploit the flaws to execute arbitrary code without authentication.
The vulnerabilities, tracked asCVE-2026-85102andCVE-2026-85103, both carry a critical CVSS severity score of 9.8 out of 10. They affect the processing and validation of digital certificates used in virtual private network connections, placing internet-facing security gateways at particular risk.
Check Point disclosed the vulnerabilities after they were discovered internally by its research team. The cybersecurity company said it had not found evidence that either vulnerability was being actively exploited at the time of disclosure.
However, because both flaws could provide a remote, unauthenticated attacker with code-execution capabilities on systems positioned at the edge of enterprise networks, organisations have been urged to deploy the available protections without delay.
“Check Point research team has identified and remediated two critical VPN-related vulnerabilities, CVE-2026-85102 and CVE-2026-85103, which could potentially allow unauthenticated remote code execution under specific conditions,” the company said in itssecurity announcement.
Check Point has not publicly explained the exact conditions necessary to exploit the vulnerabilities. This is likely intended to limit the information available to attackers while customers are still applying patches.
Certificate validation failure exposes VPN gateways
The first vulnerability,CVE-2026-85102, is an improper certificate-validation issue affecting the VPN negotiation process.
Digital certificates play a central role in establishing trusted VPN connections. During a connection attempt, the participating systems examine certificate information to verify identities, determine whether a certificate was issued by a trusted authority and confirm that it remains valid for its intended purpose.
According to Check Point, affected products fail to validate certain certificate data correctly during VPN negotiation. An unauthenticated attacker capable of reaching the VPN service could potentially provide specially constructed certificate information that causes the Security Gateway to process untrusted data incorrectly.
Under the required conditions, exploitation could result in arbitrary code execution on the gateway. The attacker would not need an existing account, valid VPN credentials or user interaction.
The weakness affects Check Point Security Gateways and Spark Firewalls configured for Remote Access VPN or site-to-site VPN operations. Site-to-site VPNs establish encrypted connections between organisational networks, branches, cloud environments or partner infrastructure, while remote-access VPNs enable employees and contractors to connect to internal systems from external locations.
Check Point lists R81.20, R82 and R82.10 among the affected supported releases. The R81.10.x and R82.00.x branches are also affected, alongside a number of older, end-of-support versions: R80, R80.10, R80.20, R80.30, R80.40, R81 and R81.10.
The company says R82.20 is not affected byCVE-2026-85102. Its full list of affected products and remediation packages is available insecurity advisory sk1000117.
The flaw is especially serious because a VPN gateway is deliberately reachable from outside the trusted network. While a conventional internal vulnerability may require an attacker to establish an initial foothold first, a flaw in an internet-facing remote-access service can potentially provide the foothold itself.
Heap overflow in ASN.1 certificate decoder
CVE-2026-85103is a separate memory-corruption vulnerability in the code used to decode the Abstract Syntax Notation One, or ASN.1, structure of VPN certificates.
ASN.1 is a standardised format for representing structured information and is widely used in cryptographic protocols and X.509 digital certificates. Before a system can examine certificate fields, it must decode the ASN.1-formatted data it receives.
A heap-based buffer overflow occurs when software writes more data into a dynamically allocated memory area than that area was designed to hold. The excess data may overwrite adjacent memory, corrupt application state or alter values that influence program execution.
Although some buffer overflows lead only to service crashes, carefully controlled memory corruption can sometimes be converted into arbitrary code execution. A successful attacker could potentially cause the vulnerable process to execute attacker-controlled instructions with its existing privileges.
TheCVE record for CVE-2026-85103describes the issue as a heap-based buffer overflow in VPN certificate ASN.1 decoding that may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.
That affected scope is important. UnlikeCVE-2026-85102, which Check Point’s advisory associates primarily with gateways and Spark Firewalls operating VPN services,CVE-2026-85103can also affect the Security Management component used to administer Check Point environments.
The company has further indicated thatCVE-2026-85103relates to certificate processing and may theoretically be triggered in an environment where the VPN Software Blade is disabled but VPN certificates remain present or processed. Administrators should therefore not assume that disabling a visible VPN feature is sufficient to eliminate exposure.
Why remote code execution on a firewall is particularly dangerous
A firewall or VPN gateway is not simply another server. It occupies a privileged position between the public internet and an organisation’s internal systems, often processing all inbound and outbound traffic while maintaining trusted connections to identity platforms, management servers and other security appliances.
If attackers obtained code execution on a gateway, the possible consequences could extend beyond disruption of the VPN service.
Depending on the affected component, execution context and subsequent access available to the attacker, a compromised gateway could potentially be used to establish persistence, steal configuration information, capture authentication material, manipulate network traffic or provide a platform for further movement into the protected environment.
Security appliances may also hold sensitive operational data, including network topology, access policies, VPN configurations, certificates and logs. An attacker who gains control over such a system may be able to interfere with the evidence defenders rely on to investigate the intrusion.
The precise post-exploitation capabilities associated with these two vulnerabilities have not been publicly established. Check Point has not released proof-of-concept code, technical exploitation details or indicators showing that attacks have occurred. Nevertheless, the potential impact reflected in the 9.8 severity scores makes the vulnerabilities high-priority issues.
The CVSS rating indicates that exploitation is considered possible over a network, requires no privileges and needs no user interaction, while successful exploitation could have a major effect on confidentiality, integrity and availability.
LivePatch protections and Jumbo Hotfixes released
Check Point has provided two principal routes for deploying the fixes: its LivePatch mechanism and updated Jumbo Hotfix Accumulator packages.
Customers who have enabled automatic Check Point LivePatch installation should receive protection through the company’s staged rollout, which began on September 9. Administrators who do not want to wait for the automatic rollout can manually download and install the relevant urgent security update.
For R81.20, R82 and R82.10, the protection is included in the urgent security update bundle identified as Take 24.
The fixes are also incorporated into the following Jumbo Hotfix Accumulator releases:
- R82.10, starting with Take 44
- R82, starting with Take 126
- R81.20, starting with Take 166
- Spark Firewall R82.00.10, starting with Build 2325
- Spark Firewall R81.10.17, starting with Build 4968
Check Point says administrators can verify installation by running cpinfo -y CPupdates in Expert mode on a Security Gateway or ClusterXL member and confirming that the applicable urgent security update bundle is installed at Take 24.
LivePatch status can be inspected with cplp list on an individual gateway or ClusterXL member. On a Scalable Platform Security Group, administrators can use g_all cplp list.
Successful output should show theCVE-2026-85102andCVE-2026-85103protection associated with the relevant certificate and VPN processes.
Organisations should verify that protection is active rather than assuming an automatically delivered update has already reached every appliance. Staged deployments can result in different systems receiving an update at different times, particularly across large or geographically distributed environments.
Temporary mitigation available for site-to-site VPNs
ForCVE-2026-85102, Check Point has published a temporary mitigation for site-to-site VPN deployments.
Administrators can disable the implied VPN rules and manually restrict UDP ports 500 and 4500 so they accept connections only from the IP addresses of authorised VPN peers. These ports are commonly associated with Internet Key Exchange and IPsec NAT traversal.
Restricting access to known peer addresses reduces the number of systems capable of initiating VPN negotiations with the gateway. It can therefore limit exposure to arbitrary hosts on the internet.
The mitigation is not applicable to locally managed Spark Firewalls and it should not be treated as a permanent replacement for installing the security update
It may also be unsuitable for some remote-access deployments because legitimate users can connect from changing or unpredictable public IP addresses. Organisations should evaluate operational requirements before modifying rules, particularly in environments that depend on mobile users, third-party access or dynamic site connectivity.
End-of-support systems present a longer-term risk
The affected version list includes several releases that have already reached the end of support. Systems running R80 through R81.10 should be treated as a broader security risk even if an organisation can obtain a temporary or exceptional fix.
Unsupported appliances do not receive the same routine security maintenance as currently supported products. They may therefore contain additional vulnerabilities for which fixes are unavailable, incomplete or more difficult to deploy.
Administrators should identify every Check Point gateway, management server, virtual appliance and Spark Firewall in the environment, record its exact software version and determine whether it remains supported.
This inventory should include standby cluster members, laboratory systems, disaster-recovery appliances and devices deployed in branch offices or cloud environments. Security teams frequently focus on primary production gateways while overlooking secondary systems that remain externally reachable.
If an affected device cannot be updated immediately, organisations should restrict its management and VPN interfaces as tightly as possible, permit connections only from explicitly authorised sources and increase monitoring around the appliance.
Exploitation has not been observed—but rapid weaponisation remains possible
Check Point says both vulnerabilities were found through internal research and that it has no indication of active exploitation. That distinguishes the disclosure from an emergency response to a known zero-day attack.
The absence of detected exploitation, however, does not establish that no attacks have occurred. Edge devices can be difficult to monitor, and intrusions affecting firewalls or VPN gateways may leave less conventional endpoint telemetry than attacks against Windows or Linux servers.
Public disclosure also changes the threat environment. Once vendors publish affected products, vulnerability categories and patch information, security researchers and threat actors can compare vulnerable and fixed software to identify the relevant code changes.
This patch-differencing process can accelerate exploit development even where the vendor withholds detailed technical information. The availability of an update should therefore be regarded as the start of a race between defenders deploying the fix and attackers attempting to reverse-engineer the vulnerability.
VPN products have become frequent targets for cybercriminals and state-linked groups because they combine internet exposure with privileged access to corporate networks. Authentication bypasses and pre-authentication remote-code-execution flaws are particularly valuable because they can eliminate the need to steal a user’s password or defeat multifactor authentication.
Check Point’s own products were targeted earlier in 2026 throughCVE-2026-50751, a separate critical authentication-bypass vulnerability affecting certain Remote Access VPN, Mobile Access and Spark Firewall configurations. Check Point reported that the earlier flaw had been exploited against several dozen organisations and was associated in at least one incident with the deployment of Qilin ransomware.CVE-2026-85102andCVE-2026-85103are separate vulnerabilities, and there is currently no evidence connecting them to that campaign.
Recommended response for organisations
Security teams should treat internet-facing Check Point gateways as the first priority and confirm whether any devices run affected versions or process VPN certificates.
Organisations should install the applicable LivePatch or Jumbo Hotfix, verify that the protection is active on every gateway and management system, and document the result through their normal change-management process.
Teams should also review firewall and VPN logs for unusual certificate-processing failures, unexplained process restarts, unexpected administrative activity, changes to access policies or unfamiliar VPN negotiations. Monitoring should extend to surrounding identity, endpoint and network systems because a successful gateway compromise could be used as an entry point for further activity.
Credentials and certificates accessible to a potentially exposed appliance should be identified in advance. If subsequent evidence indicates that a system was compromised, the response may need to include certificate revocation, credential rotation, configuration validation and examination of connected networks—not merely patch installation.
Finally, organisations should ensure that security gateways cannot be administered directly from the public internet unless there is a documented operational requirement. Management interfaces should be limited to dedicated administrative networks or approved jump hosts, protected with strong authentication and monitored for anomalous access.
The immediate priority is clear: deploy Check Point’s protections, validate their installation and reduce unnecessary exposure. Although there is no confirmed exploitation, two unauthenticated remote-code-execution vulnerabilities in perimeter security infrastructure leave little margin for delay.
