Check Point VPN: Two Unauthenticated RCE at CVSS 9.8 — CVE-2026-85102/85103 Advisory
Check Point patched two CVSS 9.8 flaws in VPN certificate handling: CVE-2026-85102 certificate trust validation defect and CVE-2026-85103 ASN.1 decode heap overflow. Unauthenticated remote attackers can execute arbitrary code on Security Gateway, Management Server, and Spark Firewall.
Incident Overview
On 9 September 2026, Check Point released an emergency security update for two critical flaws in the VPN certificate-handling path: CVE-2026-85102 and CVE-2026-85103, both CVSS 9.8 (Critical). Unauthenticated remote attackers can exploit either to execute arbitrary code on affected Security Gateway, Security Management Server, and Spark Firewall. Vendor states internal research found the issues; no in-the-wild exploitation and no public PoC at this time.
Affected Products and Versions
- Security Gateway: R80 series (EOS), R81, R81.10 (EOS), R81.10.X, R81.20, R82, R82.00.X, R82.10
- Security Management Server and Spark Firewall (centrally managed and locally managed)
- R82.20 is not affected
Technical Details
CVE-2026-85102: Certificate Trust Validation Defect
Maps to CWE-295 (Improper Certificate Validation). Lives in certificate-data checks during VPN negotiation. Unauthenticated attacker can take over a VPN session and execute arbitrary code. Prerequisite: device has Remote Access VPN or Site-to-Site VPN enabled. Affects Security Gateway only.
CVE-2026-85103: ASN.1 Decode Heap Overflow
Maps to CWE-122 (Heap-based Buffer Overflow). Lives in ASN.1 parsing of VPN certificates. Attacker sends a crafted certificate to trigger heap overflow and code execution. Unlike the former, this also hits Security Management Server—larger attack surface. Compromise of the management server yields the central config plane for the entire firewall fleet. Check Point staff confirmed the issue can theoretically trigger even if the VPN blade is disabled, as long as VPN certificates exist on the system.
Impact Assessment
Both score CVSS 9.8: network vector (AV:N), no privileges (PR:N), no user interaction (UI:N). Firewalls and VPN gateways sit at the network edge, terminate encrypted tunnels, and perform certificate validation. Compromise bypasses the entire security architecture. Historically, unauthenticated RCE on Fortinet, Palo Alto, and Ivanti edge devices was mass-weaponized within days of patch release. Treat as emergency even without current in-the-wild evidence.
Remediation
Official Patches
- R82.10: upgrade to Jumbo Hotfix Take 44 or later
- R82: upgrade to Take 126 or later
- R81.20: upgrade to Take 166 or later
- Spark Firewall: upgrade to the corresponding official build
- Environments with Live Patch enabled have received auto-push since 9 September; confirm it is applied
Temporary Mitigations
- Site-to-Site VPN: disable implied VPN rules; restrict UDP 500/4500 to trusted peer IPs
- Remote Access VPN: vendor confirms no effective mitigation; patch only
- Locally managed Spark Firewall: no temporary mitigation
Self-Check and Monitoring
# Check current Jumbo Hotfix Take version
[Expert@HostName:0]# fw ver -k
# Check VPN daemon abnormal crashes (heap overflow may first appear as a crash)
grep -i "vpnd" /var/log/messages | grep -iE "crash|core"- Inventory all Check Point assets, including branch and legacy devices
- Confirm management-server interfaces are not directly reachable from the public internet
- Watch certificate-negotiation anomalies and repeated VPN daemon crash records
References
- CERT-EU Security Advisory 2026-012
- Check Point sk1000117 (CVE-2026-85102)
- Check Point sk1000118 (CVE-2026-85103)