Check Point Discloses Two Critical 9.8-Rated VPN Flaws Allowing Unauthenticated Remote Code Execution

Check Point has released emergency security updates for two critical vulnerabilities affecting its Quantum Security Gateway and Quantum Security Management products. The flaws, tracked as CVE-2026-85102 and CVE-2026-85103, involve certificate validation and ASN.1 certificate decoding during VPN-related operations.

According to Check Point, successful exploitation could allow a remote attacker without valid credentials to execute arbitrary code on vulnerable systems. The company says the vulnerabilities were discovered internally and, at the time of disclosure, there was no indication that either flaw had been actively exploited in the wild.

Both vulnerabilities have a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating that they are remotely exploitable, require no privileges or user interaction, and could result in complete compromise of confidentiality, integrity, and availability.

CVE-2026-85102: Certificate Validation Vulnerability

The first vulnerability, CVE-2026-85102, is classified as an improper certificate validation issue under CWE-295.

The flaw occurs during VPN negotiation when the Quantum Security Gateway validates certificate trust. An attacker may be able to provide specially crafted certificate information that bypasses the expected trust validation process and ultimately leads to arbitrary code execution on the gateway.

Because the vulnerability can be triggered remotely without authentication, an attacker does not need an existing VPN account or valid credentials to attempt exploitation.

The vulnerability affects Check Point Quantum Security Gateway versions including:

• R82.10 with Jumbo Hotfix Take 43 or earlier
• R82 with Jumbo Hotfix Take 125 or earlier
• R81.20 with Jumbo Hotfix Take 165 or earlier

The vulnerability has been assigned a CVSS 3.1 score of 9.8 Critical.

CVE-2026-85103: VPN Certificate Parsing Heap Overflow

The second vulnerability, CVE-2026-85103, is a heap-based buffer overflow affecting the ASN.1 decoding process used when handling VPN certificates.

ASN.1 is commonly used to represent structured security-related data, including components of digital certificates. A memory corruption vulnerability in this processing path can potentially be abused by supplying maliciously constructed certificate data.

In this case, exploitation could allow an unauthenticated remote attacker to execute arbitrary code on vulnerable Check Point systems.

Unlike CVE-2026-85102, this vulnerability affects both:

• Quantum Security Gateway
• Quantum Security Management

The same R82.10, R82 and R81.20 Jumbo Hotfix levels are identified as affected.

Why the Vulnerabilities Are Particularly Serious

The combination of remote exploitation, no authentication requirement and high-impact consequences makes these vulnerabilities particularly dangerous for organizations exposing VPN infrastructure to the internet.

An attacker does not necessarily need to compromise an employee account first. Instead, the attack surface is the security infrastructure responsible for providing remote or site-to-site connectivity.

If successfully exploited, an attacker could potentially gain control of the security gateway or management infrastructure and use that position to:

• Intercept or manipulate network traffic
• Establish persistence inside the environment
• Deploy additional malware
• Steal credentials and sensitive configuration information
• Pivot toward internal systems
• Disrupt VPN and security services
• Modify firewall or security policies

The CVSS scoring reflects the potential for complete compromise of the affected system.

Check Point Releases Emergency Protection

Check Point has made emergency protection available through its Check Point Live Patch mechanism, while customers can also apply the appropriate Jumbo Hotfix for their deployed software version.

The vendor stated that customers using Check Point Live Patch would be automatically protected as the rollout began on September 9, 2026. Organizations that do not use Live Patch are advised to apply the appropriate security update as soon as possible.

Check Point's security advisory references the two issues separately:

• CVE-2026-85102: Authentication bypass and remote code execution involving Remote Access and Site-to-Site VPN
• CVE-2026-85103: ASN.1 decoding heap overflow leading to remote code execution

Affected Versions

CVE-2026-85102 specifically affects Quantum Security Gateway, while CVE-2026-85103 affects both Quantum Security Gateway and Quantum Security Management.

No Evidence of Active Exploitation

Despite the severity of the vulnerabilities, Check Point currently reports no indication of active exploitation.

That status should not be interpreted as a reason to delay remediation. Internet-facing VPN gateways are attractive targets because they sit at the boundary between external networks and internal corporate environments.

The availability of detailed vulnerability information can also make rapid exploitation more likely after public disclosure, particularly for systems that remain exposed and unpatched.

Security teams should therefore treat the vulnerabilities as high-priority remediation items rather than waiting for exploitation reports.

Security Teams Should Prioritize VPN Infrastructure

Organizations using Check Point Quantum products should immediately determine whether vulnerable versions are deployed across their environments.

Recommended actions include:

1. Inventory all Check Point Quantum gateways and management systems.
2. Verify the exact Jumbo Hotfix level installed on each system.
3. Deploy Check Point's emergency security updates or Live Patch protection.
4. Confirm that the protection is active after installation.
5. Review VPN authentication and certificate configurations.
6. Monitor internet-facing VPN infrastructure for unusual connection attempts.
7. Search security logs for suspicious activity around VPN negotiation and certificate processing.
8. Investigate unexpected administrative activity or configuration changes.
9. Review systems connected to potentially exposed gateways for signs of lateral movement.
10. Continue monitoring for exploitation attempts following public disclosure.

Check Point's own security guidance recommends installing the latest available Jumbo Hotfix for the affected deployment, while Live Patch provides an additional remediation path for supported systems.

Patching Should Be Followed by Threat Hunting

Applying the fix is only one part of the response.

Because these vulnerabilities affect network security infrastructure, organizations should also investigate whether vulnerable gateways were exposed before remediation.

Security teams should examine:

• VPN connection logs
• Authentication failures and unusual authentication patterns
• Unexpected certificate-related events
• Administrative login activity
• Configuration modifications
• Newly created accounts
• Unusual outbound connections from gateways
• Unexpected processes or files
• Changes to firewall and VPN policies
• Connections from previously unseen external infrastructure

Organizations that identify suspicious activity should expand the investigation to systems reachable from the affected gateway or management infrastructure.

Broader Implications for VPN Security

The disclosure highlights the continuing security risks associated with internet-facing VPN infrastructure.

VPN gateways are designed to process untrusted network traffic and certificate information before users or remote systems gain access to protected environments. Vulnerabilities in those processing paths can therefore provide attackers with a valuable route into enterprise networks.

The combination of network-level reachability, no authentication requirement and remote code execution makes vulnerabilities in VPN appliances particularly important to address quickly.

Although Check Point has not reported exploitation of these two vulnerabilities, defenders should assume that exposed, vulnerable systems will attract increased scanning and exploitation attempts following public disclosure.

Conclusion

Check Point's disclosure of CVE-2026-85102 and CVE-2026-85103 highlights the risks posed by vulnerabilities in VPN certificate processing.

Both vulnerabilities carry the maximum CVSS 3.1 score of 9.8, and both can potentially lead to unauthenticated remote code execution. CVE-2026-85102 involves improper certificate trust validation, while CVE-2026-85103 is a heap-based buffer overflow in VPN certificate ASN.1 decoding.

With emergency protections now available, organizations running affected Check Point Quantum products should prioritize verification and remediation rather than waiting for evidence of active exploitation.

For security teams, the key takeaway is straightforward: treat internet-facing VPN infrastructure as a critical attack surface, patch vulnerable Check Point systems immediately, verify that the protection is active, and conduct threat hunting for signs of compromise.