InfoSecBulletin Cybersecurity for mankind
Check Point Software has revealed and fixed two major VPN flaws, CVE-2026-85102 and CVE-2026-85103. Both have a top CVSS score of 9.8 and can let unverified users run code from far away in certain situations. Check Point’s research team found the flaws, and the company says there is no proof of active use or public code that shows it as of now.
Check Point VPN Vulnerabilities
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
CVE-2026-85102 is rooted in improper certificate trust validation during VPN negotiation, tracked under CWE-295. The Check Point advisory sk1000117 says there is a problem with how it checks a certificate’s trust. This allows an attacker without permission to take control of the VPN connection and run any code on the Security Gateway. It impacts both Remote Access VPN and Site-to-Site VPN setups.
CVE-2026-85103 is a heap-based buffer overflow (CWE-122) that happens when the product reads the ASN.1 structure of a VPN certificate. As explained in advisory sk1000118, this flaw allows a remote attacker to cause the overflow by sending a harmful certificate, which could lead to code execution on Quantum Security Gateway and Quantum Security Management systems.
The flaws impact Check Point Security Gateway, Security Management Server, and Spark Firewall on many versions, like R81.20, R82, and R82.10 with Jumbo Hotfix. They also affect some older versions that are no longer supported, like R80.40 and R81. Check Point said that R82.20 is safe.
Notably, CVE-2026-85102 primarily impacts Security Gateways engaged in VPN connections, while CVE-2026-85103 spans both gateway and management infrastructure.
Organizations that use Check Point Live Patch get benefits automatically since the rollout started on September 9, 2026. Admins who do not have Live Patch on must install the latest Jumbo Hotfix Accumulator for their branch by hand. This includes R82.10 Take 44 or higher, R82 Take 126 or higher, or R81.20 Take 166 or higher, along with specific Spark Firewall builds.
For Site-to-Site VPN setups that can’t be patched right away, Check Point suggests turning off implied VPN rules and limiting UDP ports 500 and 4500 to trusted peer IP addresses. However, this fix does not apply to Remote Access VPN, and there is no temporary solution for locally managed Spark Firewalls.
These newly patched bugs are unrelated to the actively exploited CVE-2026-50751, an IKEv1 authentication bypass tied to Qilin ransomware activity disclosed earlier this year.
Security teams using Check Point systems should fix the new flaws right away because they are very serious and can be exploited over the network, instead of waiting to see if they are being used in attacks.
