Check Point Fixes Critical VPN Vulnerabilities

Post Views: 8

Cybersecurity firm Check Point released updates to address two high-severity flaws in its gateway and firewall products that utilize virtual private network (VPN) capabilities.

Overview of the Vulnerabilities

The vulnerabilities, identified as CVE-2026-85102 and CVE-2026-85103, carry a CVSS score of 9.8 and could enable remote code execution (RCE) without requiring authentication, according to the company.

Details of the Vulnerabilities

CVE-2026-85102

Arises from insufficient validation of certificate data during the VPN negotiation process.

CVE-2026-85103

Stems from a heap overflow in the VPN certificate ASN.1 decoding mechanism.

Affected Products and Configurations

Both issues affect a range of Check Point products, including the Security Gateway and Check Point Spark Firewall when deployed with Site to Site VPN or Remote Access VPN configurations. Additionally, CVE-2026-85103 impacts the Check Point Security Management Server, Security Gateway, and Spark Firewall.

Patches and Mitigation Steps

Patches have been issued for versions R82.10, R82, and R81.20 across all affected systems. To mitigate risks before applying updates, Check Point advises users to manually configure VPN rules. Specifically, for Site to Site VPN setups, administrators should disable implied rules related to VPN traffic and explicitly define access for UDP ports 500 and 4500 for designated peer IP addresses. However, this workaround does not apply to locally managed Spark Firewall instances, which require immediate installation of the latest Jumbo hotfixes. Customers utilizing Check Point LivePatch will receive the necessary updates automatically.

Conclusion and Recommendations

The company confirmed that both vulnerabilities were identified internally and that no evidence of active exploitation in the wild has been detected. This follows earlier disclosures this summer regarding the use of two zero-day flaws, including CVE-2026-16232 and CVE-2026-50751, by threat actors. The recent patches underscore ongoing efforts to address critical weaknesses in enterprise networking infrastructure. Users are urged to apply the updates promptly to prevent potential exploitation. The advisories highlight the importance of proactive patch management in securing VPN environments, which remain a frequent target for cyberattacks due to their role in remote access and network segmentation.