Check Point VPN Flaws Let Remote Attackers Run Code on Gateways and Servers

Check Point has patched two critical flaws in the certificate-processing paths used by its VPN products. CVE-2026-85102 lets an unauthenticated remote attacker reach code execution on affected Security Gateways. CVE-2026-85103 lets a remote attacker reach code execution on Security Gateways and Security Management Servers. Operators running supported R81.20, R82, or R82.10 branches need a fixed Jumbo Hotfix take or Check Point LivePatch urgent security update Take 24.

The two vulnerabilities, CVE-2026-85102 and CVE-2026-85103, each carry a 9.8 CVSS score. Check Point’s advisories do not report active exploitation or public proof-of-concept code, and they do not quantify installed or exposed systems. Version R82.20 is explicitly unaffected.

Certificate Processing Flaws Enable Code Execution

CVE-2026-85102 begins during VPN negotiation. Check Point says improper validation of certificate data may let an unauthenticated attacker execute arbitrary code on a Security Gateway. The affected surface includes Site-to-Site VPN and Remote Access VPN on Security Gateways and centrally or locally managed Spark Firewalls.

CVE-2026-85103 reaches a different parser. A heap overflow occurs while the product decodes the ASN.1 structure of a VPN certificate. The vendor says this path may execute arbitrary code on both Security Gateways and Security Management Servers, broadening the target set beyond the first flaw.

Figure details

A remote certificate enters two separate Check Point VPN processing paths. CVE-2026-85102 passes through improper certificate validation during VPN negotiation and lets an unauthenticated attacker reach code execution on Security Gateways and Spark Firewalls. CVE-2026-85103 passes through ASN.1 certificate decoding, triggers a heap overflow, and lets a remote attacker reach code execution on Security Gateways, Spark Firewalls, and Security Management Servers. Its advisory does not characterize this path as unauthenticated. The two paths converge on the same code-execution consequence while retaining their different attacker and target scopes.

Check Point describes both outcomes as conditional: each advisory says the flaw “may allow” remote code execution. The primary record does not identify a vulnerable function, packet sequence, configuration beyond VPN use, crash signature, log marker, or compromise indicator. Check patch and LivePatch status to identify systems that still need protection; the vendor has supplied no exploit telemetry for compromise checks.

Supported and legacy branches differ

Both advisories list R81.20, R82, and R82.10 as affected supported branches. They also include end-of-support releases from R80 through R81.10, plus the embedded lines R81.10.x and R82.00.x. The affected-product list differs slightly: CVE-2026-85102 is scoped to gateways and Spark Firewalls using VPN, while CVE-2026-85103 includes Security Management Server as well.

The branch-specific fixed floors are Jumbo Hotfix Accumulator R82.10 Take 44, R82 Take 126, and R81.20 Take 166. For Spark Firewalls, Check Point names R82.00.10 Build 2325 and R81.10.17 Build 4968 as the first fixed builds. The advisories list no fixed floor for older end-of-support branches, so those systems need a supported migration path.

A management server without VPN termination can still fall inside the CVE-2026-85103 scope, while a gateway’s exposure depends on whether it uses Site-to-Site or Remote Access VPN for CVE-2026-85102. Inventory should capture product role, release train, installed take or build, and LivePatch state.

LivePatch protects named processes

Check Point’s urgent security update is bundle Take 24 for R81.20, R82, and R82.10. Customers with automatic LivePatch installation enabled should receive it automatically. Offline packages are also available for manual deployment.

The vendor’s terse solution statement is direct: “This problem was fixed.” The more useful operational evidence follows it. On a Security Gateway or ClusterXL member, run cpinfo -y CPupdates in Expert mode and confirm that the branch-appropriate BUNDLE_URGENT_SECURITY_UPDATE_*_AUTOUPDATE entry reports Take 24.

Then run cplp list on a gateway or ClusterXL member. On a Scalable Platform Security Group, use g_all cplp list. Check Point’s expected output associates both CVEs with protected processes including cpcert:cpca*, cpcert:iked*, cpcert:vpn*, and cpcert:vpnrad*; the CVE-2026-85102 advisory also lists cpcert:wstlsd*. The presence of the bundle declaration alone is weaker evidence than the process-level protection list.

Restrict site-to-site peers

For Site-to-Site VPN deployments that cannot patch immediately, Check Point documents a bounded mitigation: disable implied VPN rules, then define access to UDP ports 500 and 4500 only for the specific peer IP addresses. This reduces who can reach the affected negotiation path.

Check Point says it does not apply to locally managed Spark Firewalls, and the advisories do not present it as a Remote Access VPN mitigation. Those systems need the LivePatch or fixed build path. Administrators should also preserve a record of every temporary peer rule so the workaround does not become a permanent, opaque access policy.

The advisories supply no source-backed exploit signature or compromise-recovery procedure. A clean LivePatch or version result confirms current protection against the published flaws; earlier targeting still requires separate evidence. Unexpected crashes, management changes, or VPN policy changes still require ordinary incident triage, but the primary record provides no CVE-specific pivot for that work.

Verify Updates and Protected Processes

Classify each Security Gateway, Security Management Server, and Spark Firewall by role and release. The expected safe state is R82.20, a fixed Jumbo Hotfix take, a fixed Spark build, or LivePatch urgent security update Take 24 with both CVEs attached to the relevant protected processes.

Run cpinfo -y CPupdates, then cplp list or g_all cplp list as appropriate. A passing result shows Take 24 and process entries for CVE-2026-85102 and CVE-2026-85103; a missing CVE or process entry leaves that system’s LivePatch protection unverified. Where patching must wait, restrict Site-to-Site VPN traffic on UDP 500 and 4500 to known peers and record that the workaround does not cover locally managed Spark or Remote Access VPN.

Retain process-level protection results for each gateway or management-server role. Use the version inventory to identify affected systems and the LivePatch listing to check that the fix is active in processes that parse VPN certificates.