Check Point Patches Critical VPN Vulnerabilities

Cybersecurity firm Check Point this week announced patches for two critical-severity vulnerabilities in its gateway and firewall products using VPN functionality.

Tracked as CVE-2026-85102 and CVE-2026-85103 (CVSS score of 9.8), both security defects could be exploited without authentication for remote code execution (RCE), Check Point warns.

The former is described as an improper validation of certificate data during VPN negotiation, while the latter is a heap overflow in the VPN certificate ASN.1 decoding flow.

CVE-2026-85102, the company says, affects Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN.

CVE-2026-85103 impacts the Check Point Security Management Server, Security Gateway, and Spark Firewall.

Check Point Patches Critical VPN Vulnerabilities

Other newsrooms on this story

Related reading

Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling…

Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups

Check Point links VPN zero-day attacks to Qilin ransomware gang

Check Point VPN Flaw Exploited Since Early May

New Check Point Zero-Day Vulnerability Exploited in the Wild

Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks