Check Point patches two critical VPN certificate flaws

Check Point published two critical VPN certificate bugs, both scored CVSS 9.8, and said it has no indication either has been used in an attack. The SecureKnowledge advisories, last modified 9 September 2026, are sk1000117 for CVE-2026-85102 and sk1000118 for CVE-2026-85103. Canada's Cyber Centre alert AV26-902, dated the same day, points administrators at those two pages. Neither CVE is on the CISA Known Exploited Vulnerabilities list.

CVE-2026-85102 is improper validation of certificate data during VPN negotiation. Check Point says that may let an unauthenticated remote attacker run code on the Security Gateway. It affects Security Gateway and Spark Firewall using Site-to-Site or Remote Access VPN.

CVE-2026-85103 is a heap overflow in VPN certificate ASN.1 decoding. The advisory title and the CCCS listing say that may allow remote code execution on Security Management Server, Security Gateway, and Spark. Affected branches include R81.20, R82, and R82.10, plus older end-of-support lines. R82.20 is listed as not affected.

The urgent LivePatch package is Take 24 for R82.10, R82, and R81.20. Permanent Jumbo Hotfix floors named with those advisories are R82.10 Take 44, R82 Take 126, and R81.20 Take 166. Spark fixes are R82.00.10 Build 2325 and R81.10.17 Build 4968.

For Site-to-Site VPN, Check Point's mitigation is to disable implied VPN rules and manually define UDP/500 and UDP/4500 for specific peer IP addresses. That workaround does not apply to locally managed Spark. Check Point says remote code execution requires specific conditions it has not fully spelled out in the public summaries.

The Hacker News, reading the customer community thread, reported R81.10 operators still without LivePatch or Jumbo, and some automatic LivePatch rollouts still sitting on Take 17 or Take 18. The pair sits in the same edge-device class as WatchGuard Firebox RCE now marked for ransomware use, without the active-use flag Check Point says is still missing here.

Some offers on this page may be paid placements or contain affiliate links.