Two critical Check Point VPN vulnerabilities could expose organizations to remote code execution. Both flaws carry CVSS scores of 9.8. Attackers may exploit vulnerable systems without valid credentials. The vulnerabilities affect several Check Point VPN and security products.
Why These Vulnerabilities Matter
VPN gateways often provide trusted access into corporate networks. That position makes compromised gateways extremely valuable to attackers. An attacker could gain access without obtaining valid VPN credentials. Successful exploitation could provide access to sensitive internal systems.
Attackers could also steal information or move deeper into networks. Compromised gateways could support ransomware attacks or other malicious activity.
CVE-2026-85102
The first vulnerability is tracked as CVE-2026-85102. It affects certificate validation during VPN connection negotiations. The flaw can impact Remote Access VPN connections. It can also affect Site-to-Site VPN configurations.
An attacker may bypass authentication checks under certain conditions. Successful exploitation could then allow remote code execution. The attack does not require valid VPN credentials. This makes internet-facing gateways particularly important patching targets.
CVE-2026-85103
The second vulnerability is tracked as CVE-2026-85103. This vulnerability involves ASN.1 certificate decoding. ASN.1 is commonly used for certificates and network communications. The vulnerability causes a heap-based buffer overflow.
Specially crafted certificate data could trigger memory corruption. That corruption could eventually allow remote code execution. This vulnerability also affects some Check Point management systems. Those systems may require patches even when VPN services are disabled.
Large-Scale Exploitation Expected
The Dutch NCSC issued an urgent warning about these vulnerabilities. The agency expects widespread exploitation attempts could begin soon. Public exploit code was unavailable when the warning was published. Check Point also reported no confirmed exploitation at that time.
However, attackers commonly target vulnerabilities in internet-facing security appliances. Organizations should not wait for confirmed attacks before installing updates.
Affected Check Point Versions
Several Check Point software releases require updated Jumbo Hotfix packages. R82.10 systems should use Take 44 or later. R82 systems should use Take 126 or later. R81.20 systems should use Take 166 or later.
Check Point began distributing LivePatch protections on September 9. Administrators should confirm LivePatch protections were successfully installed. Automatic protection should never replace verification during critical security events.
Organizations Should Patch Immediately
Administrators should identify every internet-facing Check Point security appliance. They should confirm each appliance’s software version and hotfix level. Vulnerable systems should receive the appropriate security updates immediately.
Administrators should review Check Point’s official security advisory before patching.
Security teams should also review logs for suspicious activity. Unexpected VPN connections should receive additional investigation. Administrators should investigate unusual crashes or configuration changes. Suspicious certificate activity should also receive immediate attention.
Additional VPN Protections
Site-to-Site VPN environments should restrict unnecessary internet exposure. Administrators can limit UDP port 500 to trusted peer addresses. They can also restrict UDP port 4500 to trusted peers.
These restrictions can reduce exposure while organizations complete patching. Administrators should also review implied VPN rules carefully.
The Bottom Line
These vulnerabilities create serious risks for organizations using Check Point products. Authentication bypasses and remote execution increase the potential damage. Internet-facing VPN gateways deserve immediate attention from security teams.
Organizations should patch affected systems before widespread exploitation begins. Security teams should also monitor systems after patches are deployed. Fast patching can significantly reduce exposure to these critical vulnerabilities.
