InfoSecBulletin Cybersecurity for mankind
Check Point Software has revealed and fixed two major VPN flaws, CVE-2026-85102 and CVE-2026-85103. Both have a top CVSS score of 9.8 and can let unverified users run code from far away in certain situations. Check Point’s research team found the flaws, and the company says there is no proof of active use or public code that shows it as of now.
Check Point VPN Vulnerabilities
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
CVE-2026-85102 is rooted in improper certificate trust validation during VPN negotiation, tracked under CWE-295. The Check Point advisory sk1000117 says there is a problem with how it checks a certificate’s trust. This allows an attacker without permission to take control of the VPN connection and run any code on the Security Gateway. It impacts both Remote Access VPN and Site-to-Site VPN setups.
CVE-2026-85103 is a heap-based buffer overflow (CWE-122) that happens when the product reads the ASN.1 structure of a VPN certificate. As explained in advisory sk1000118, this flaw allows a remote attacker to cause the overflow by sending a harmful certificate, which could lead to code execution on Quantum Security Gateway and Quantum Security Management systems.
The flaws impact Check Point Security Gateway, Security Management Server, and Spark Firewall on many versions, like R81.20, R82, and R82.10 with Jumbo Hotfix. They also affect some older versions that are no longer supported, like R80.40 and R81. Check Point said that R82.20 is safe.
Notably, CVE-2026-85102 primarily impacts Security Gateways engaged in VPN connections, while CVE-2026-85103 spans both gateway and management infrastructure.
Organizations that use Check Point Live Patch get benefits automatically since the rollout started on September 9, 2026. Admins who do not have Live Patch on must install the latest Jumbo Hotfix Accumulator for their branch by hand. This includes R82.10 Take 44 or higher, R82 Take 126 or higher, or R81.20 Take 166 or higher, along with specific Spark Firewall builds.
For Site-to-Site VPN setups that can’t be patched right away, Check Point suggests turning off implied VPN rules and limiting UDP ports 500 and 4500 to trusted peer IP addresses. However, this fix does not apply to Remote Access VPN, and there is no temporary solution for locally managed Spark Firewalls.
These newly patched bugs are unrelated to the actively exploited CVE-2026-50751, an IKEv1 authentication bypass tied to Qilin ransomware activity disclosed earlier this year.
Security teams using Check Point systems should fix the new flaws right away because they are very serious and can be exploited over the network, instead of waiting to see if they are being used in attacks.
