InfoSecBulletin Cybersecurity for mankind
Check Point Software has revealed and fixed two major VPN flaws, CVE-2026-85102 and CVE-2026-85103. Both have a top CVSS score of 9.8 and can let unverified users run code from far away in certain situations. Check Point’s research team found the flaws, and the company says there is no proof of active use or public code that shows it as of now.
Check Point VPN Vulnerabilities
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft Patch Tuesday September 2026 Fixed 973 Flaws Fixed, 2 Zero-Days
A single call: ShinyHunters Gained Access to 6 Million Customers’ Records
CVE-2026-85102 is rooted in improper certificate trust validation during VPN negotiation, tracked under CWE-295. The Check Point advisory sk1000117 says there is a problem with how it checks a certificate’s trust. This allows an attacker without permission to take control of the VPN connection and run any code on the Security Gateway. It impacts both Remote Access VPN and Site-to-Site VPN setups.
CVE-2026-85103 is a heap-based buffer overflow (CWE-122) that happens when the product reads the ASN.1 structure of a VPN certificate. As explained in advisory sk1000118, this flaw allows a remote attacker to cause the overflow by sending a harmful certificate, which could lead to code execution on Quantum Security Gateway and Quantum Security Management systems.
The flaws impact Check Point Security Gateway, Security Management Server, and Spark Firewall on many versions, like R81.20, R82, and R82.10 with Jumbo Hotfix. They also affect some older versions that are no longer supported, like R80.40 and R81. Check Point said that R82.20 is safe.
Notably, CVE-2026-85102 primarily impacts Security Gateways engaged in VPN connections, while CVE-2026-85103 spans both gateway and management infrastructure.
Organizations that use Check Point Live Patch get benefits automatically since the rollout started on September 9, 2026. Admins who do not have Live Patch on must install the latest Jumbo Hotfix Accumulator for their branch by hand. This includes R82.10 Take 44 or higher, R82 Take 126 or higher, or R81.20 Take 166 or higher, along with specific Spark Firewall builds.
For Site-to-Site VPN setups that can’t be patched right away, Check Point suggests turning off implied VPN rules and limiting UDP ports 500 and 4500 to trusted peer IP addresses. However, this fix does not apply to Remote Access VPN, and there is no temporary solution for locally managed Spark Firewalls.
These newly patched bugs are unrelated to the actively exploited CVE-2026-50751, an IKEv1 authentication bypass tied to Qilin ransomware activity disclosed earlier this year.
Security teams using Check Point systems should fix the new flaws right away because they are very serious and can be exploited over the network, instead of waiting to see if they are being used in attacks.
