Check Point Patches Two Critical VPN Certificate Flaws That Could Enable Unauthenticated RCE
Summary
Check Point patched two CVSS 9.8 VPN certificate flaws that could enable unauthenticated remote code execution on affected Security Gateway and Security Management systems. The company reports no known exploitation and is distributing fixes through Live Patch and Jumbo
Key points
- CVE-2026-85102 involves certificate trust validation during VPN negotiation on Security Gateways.
- CVE-2026-85103 is a heap-based buffer overflow in VPN certificate decoding and affects Security Gateways and Security Management systems.
- Both flaws are rated CVSS 9.8 and could allow unauthenticated remote code execution under specific conditions that Check Point has not detailed.
- Affected versions listed include R82.10, R82, and R81.20 at specified Jumbo Hotfix take levels; the article says the records do not identify fixed versions.
- Check Point began distributing fixes on September 9 through Live Patch and Jumbo Hotfix updates.
- Check Point says it found the flaws internally and has no evidence of external exploitation; it has not published indicators of compromise.
- Some customers reported delayed automatic updates, broken advisory links, and uncertainty about mitigation or support for R81.10.
Article Details
- Vulnerability Types
- Failure to properly validate certificate trust during VPN negotiation
- Heap-based buffer overflow during ASN.1 decoding of a VPN certificate
- Severity
- Critical; both vulnerabilities are rated CVSS 9.8.
- Affected Versions
- Quantum Security Gateway R82.10 with Jumbo Hotfix Take 43 or below
- Quantum Security Gateway R82 with Jumbo Hotfix Take 125 or below
- Quantum Security Gateway R81.20 with Jumbo Hotfix Take 165 or below
- Quantum Security Management R82.10 with Jumbo Hotfix Take 43 or below
- Quantum Security Management R82 with Jumbo Hotfix Take 125 or below
- Quantum Security Management R81.20 with Jumbo Hotfix Take 165 or below
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- The advisory's mitigation was described as turning off implied rules for VPN; the article reports that customers found the guidance too vague to apply.
CVE
CVE-2026-16232checkpoint · Multi-Domain Security Management; checkpoint · Quantum Security ManagementJuly’s was CVE-2026-16232, a SmartConsole authentication bypass, which CISA added to the same catalog on the day it was disclosed.CVE-2026-50751checkpoint · Quantum Security Gateway; checkpoint · Spark FirewallsJune’s was CVE-2026-50751, an authentication bypass in Remote Access VPN and Mobile Access certificate validation.CVE-2026-85102checkpoint · Quantum Security GatewayCheck Point has patched two critical VPN certificate flaws, CVE-2026-85102 and CVE-2026-85103, that could let an unauthenticated remote attacker execute code on Security Gateway and Security Management systems underCVE-2026-85103checkpoint · Quantum Security Gateway; checkpoint · Quantum Security ManagementCheck Point has patched two critical VPN certificate flaws, CVE-2026-85102 and CVE-2026-85103, that could let an unauthenticated remote attacker execute code on Security Gateway and Security Management systems under
Vendors
Products
Mobile AccessJune’s was CVE-2026-50751, an authentication bypass in Remote Access VPN and Mobile Access certificate validation.Quantum Security GatewayIts record says an unauthenticated remote attacker may be able to run code on Quantum Security Management and Quantum Security Gateway systems.Quantum Security ManagementIts record says an unauthenticated remote attacker may be able to run code on Quantum Security Management and Quantum Security Gateway systems.Remote Access VPNSpark appears twice, once for deployments using Site-to-Site or Remote Access VPN and once without that condition.Security GatewayCVE-2026-85102 and CVE-2026-85103, that could let an unauthenticated remote attacker execute code on Security Gateway and Security Management systems under specific conditions.Security Management ServerThe other affects those gateways and the Security Management Server, the console used to configure them.SmartConsoleJuly’s was CVE-2026-16232, a SmartConsole authentication bypass, which CISA added to the same catalog on the day it was disclosed.Spark FirewallIt lists Security Gateway, Security Management Server, and Spark Firewall, Check Point’s small-business line.