InfoSecBulletin Cybersecurity for mankind
Check Point Software has revealed and fixed two major VPN flaws, CVE-2026-85102 and CVE-2026-85103. Both have a top CVSS score of 9.8 and can let unverified users run code from far away in certain situations. Check Point’s research team found the flaws, and the company says there is no proof of active use or public code that shows it as of now.
Check Point VPN Vulnerabilities
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
CVE-2026-85102 is rooted in improper certificate trust validation during VPN negotiation, tracked under CWE-295. The Check Point advisory sk1000117 says there is a problem with how it checks a certificate’s trust. This allows an attacker without permission to take control of the VPN connection and run any code on the Security Gateway. It impacts both Remote Access VPN and Site-to-Site VPN setups.
CVE-2026-85103 is a heap-based buffer overflow (CWE-122) that happens when the product reads the ASN.1 structure of a VPN certificate. As explained in advisory sk1000118, this flaw allows a remote attacker to cause the overflow by sending a harmful certificate, which could lead to code execution on Quantum Security Gateway and Quantum Security Management systems.
The flaws impact Check Point Security Gateway, Security Management Server, and Spark Firewall on many versions, like R81.20, R82, and R82.10 with Jumbo Hotfix. They also affect some older versions that are no longer supported, like R80.40 and R81. Check Point said that R82.20 is safe.
Notably, CVE-2026-85102 primarily impacts Security Gateways engaged in VPN connections, while CVE-2026-85103 spans both gateway and management infrastructure.
Organizations that use Check Point Live Patch get benefits automatically since the rollout started on September 9, 2026. Admins who do not have Live Patch on must install the latest Jumbo Hotfix Accumulator for their branch by hand. This includes R82.10 Take 44 or higher, R82 Take 126 or higher, or R81.20 Take 166 or higher, along with specific Spark Firewall builds.
For Site-to-Site VPN setups that can’t be patched right away, Check Point suggests turning off implied VPN rules and limiting UDP ports 500 and 4500 to trusted peer IP addresses. However, this fix does not apply to Remote Access VPN, and there is no temporary solution for locally managed Spark Firewalls.
These newly patched bugs are unrelated to the actively exploited CVE-2026-50751, an IKEv1 authentication bypass tied to Qilin ransomware activity disclosed earlier this year.
Security teams using Check Point systems should fix the new flaws right away because they are very serious and can be exploited over the network, instead of waiting to see if they are being used in attacks.
