CVE-2026-85103

Check Point Patches Two Critical VPN Vulnerabilities Allowing Unauthenticated Remote Code Execution

Check Point has released fixes for two critical vulnerabilities affecting its Security Gateway, Security Management Server, and locally managed Spark Firewall products. Both flaws received a CVSS score of 9.8 and enable remote code execution without requiring authentication. CVE-2026-85102 resides in certificate trust validation during VPN negotiation, allowing an unauthenticated attacker to force the process and execute arbitrary code. CVE-2026-85103 is a heap buffer overflow triggered while parsing the ASN.1 structure of VPN certificates. Affected versions include R81.20, R82, and R82.10 before the listed hotfixes, as well as unsupported R80.40 and R81 releases. R82.20 remains unaffected. The issues were discovered internally by Check Point researchers, with no active exploitation or public proof-of-concept observed as of the September 10 disclosure.

Critical RCE Vulnerabilities Disclosed in Check Point VPN Implementations

Check Point Software Technologies has disclosed multiple critical remote code execution vulnerabilities affecting its Quantum Security Gateway and related VPN components. The issues, tracked as CVE-2026-85102 and CVE-2026-85103, both carry a CVSS v3.1 base score of 9.8 and require no authentication for exploitation under specific conditions. CVE-2026-85102 stems from insufficient certificate validation during VPN negotiation in Remote Access VPN and Site-to-Site VPN setups, allowing attackers to bypass authentication and execute arbitrary code. CVE-2026-85103 involves a heap-based buffer overflow in ASN.1 decoding of VPN certificates, similarly enabling unauthenticated remote code execution. The vendor released a security advisory on September 9, 2026, along with live patches through Check Point Live Patch and official updates for affected products including Quantum Security Management.