Cybersecurity leader Check Point has released urgent patches for two critical vulnerabilities (CVE-2026-85102 and CVE-2026-85103) in its VPN-enabled gateways and firewalls that could lead to remote code execution.
- Two critical flaws, CVE-2026-85102 and CVE-2026-85103, have been patched.
- Both vulnerabilities carry a severe CVSS score of 9.8.
- Attackers could achieve Remote Code Execution (RCE) without any authentication.
- Impacts Security Gateways, Spark Firewalls, and Management Servers.
The cybersecurity firm Check Point has issued an urgent security advisory regarding two critical-severity vulnerabilities affecting its gateway and firewall products. These flaws, specifically tied to VPN functionality, could potentially allow unauthenticated attackers to execute arbitrary code remotely, bypassing traditional security perimeters.
The first vulnerability, CVE-2026-85102, stems from improper validation of certificate data during the VPN negotiation process. The second, CVE-2026-85103, involves a heap overflow within the VPN certificate ASN.1 decoding flow. Together, these flaws create a high-risk scenario where a malicious actor could seize control of a network gateway without needing a single password.
Why This Matters
BozokMedia analysis shows that when a core security appliance—designed to be the 'gatekeeper' of a network—possesses a vulnerability with a 9.8 CVSS score, the risk profile of the entire organization shifts. Because these flaws are unauthenticated, they remove the primary barrier (identity verification), making them prime targets for state-sponsored actors or ransomware gangs seeking initial access.
"Unauthenticated RCE in a VPN gateway is the digital equivalent of finding a master key left in the front door of a fortress."
The company has released security updates for versions R82.10, R82, and R81.20. While customers with Check Point LivePatch enabled will receive these updates automatically, those managing Spark Firewall instances locally must manually apply the latest Jumbo hotfixes to secure their environments.
To mitigate immediate risks, Check Point recommends a manual definition of VPN rules. For Site-to-Site VPNs, administrators are urged to disable implied rules and strictly define VPN access for UDP/500 and UDP/4500 only for specific, trusted peer IP addresses.
Historical Background
This is not the first time Check Point has faced such critical challenges. Earlier this summer, the firm warned users about two other zero-day vulnerabilities, CVE-2026-16232 and CVE-2026-50751. This trend highlights the increasing complexity of VPN protocols and the constant arms race between security vendors and exploit developers.
| CVE ID | Affected Products | Technical Root Cause |
|---|---|---|
| CVE-2026-85102 | Security Gateway, Spark Firewall | Improper Certificate Validation |
| CVE-2026-85103 | Management Server, Gateway, Spark Firewall | ASN.1 Decoding Heap Overflow |
Frequently Asked Questions
Q1: Is there evidence that these flaws were exploited in the wild?
A: No, Check Point stated that both vulnerabilities were discovered internally and there is currently no evidence of active exploitation.
Q2: What is the fastest way to secure my system?
A: Enable LivePatch for automatic updates or immediately apply the latest Jumbo hotfixes and restrict VPN traffic to known peer IPs.
