CVE-2026-85102

What is Check Point Security Gateway?

Check Point Security Gateway is the enforcement half of Check Point's firewall platform: the appliance or virtual machine that sits at a network perimeter, applies the policy pushed to it by a Security Management Server, and terminates the organization's VPN tunnels. Spark Firewall is the small and branch office line running the same VPN stack in a fixed-function appliance, sold both centrally managed and locally managed.

Both products are valuable targets for the same reason: they are deliberately internet-facing, they sit in front of the network rather than inside it, and the VPN service they run must answer unauthenticated packets from arbitrary sources before it can decide whether a peer is legitimate. Code execution on a Security Gateway does not just breach one host, it lands the attacker on the device that defines and enforces the boundary, with visibility of the decrypted traffic crossing it.

Overview

CVE-2026-85102 is an improper certificate validation flaw in the VPN negotiation flow. The gateway does not correctly validate the trust of the certificate data a peer presents, which lets an unauthenticated remote attacker drive the negotiation far enough to execute arbitrary code on the gateway. The CVE carries a CVSS 3.1 base score of 9.8 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Exploitation requires the deployment to be configured for Site-to-Site VPN or Remote Access VPN. That is not much of a limit in practice; VPN termination is one of the main reasons these appliances are deployed at all.

Check Point found the flaw internally, published sk1000117 on 2026-09-09, and stated at the time that there was no evidence of exploitation in the wild. That changed quickly. In a follow-up advisory on 2026-09-22 the vendor reported exploitation attempts against Spark Firewall customers globally beginning 2026-09-12, three days after the fix shipped. CISA added the CVE to the Known Exploited Vulnerabilities catalog the same day, with a remediation deadline of 2026-09-25.

A companion bug, CVE-2026-85103, a heap overflow in the VPN certificate ASN.1 decoding flow, was disclosed alongside it and is also rated 9.8. Only CVE-2026-85102 is in KEV at the time of writing.

Affected Versions

R82.20 is not listed as affected. The R80 series and R81 are past end of support and receive no hotfix, so those deployments need a version upgrade rather than a patch.

Technical Details

The weakness is CWE-295, improper certificate validation. In plain terms, the gateway accepts a certificate presented during VPN negotiation without properly establishing that it chains to a trusted authority. Certificate validation is the step that decides whether the party on the other end is who it claims to be; when that check is incomplete, an attacker can present certificate material of their own choosing and still be carried through the negotiation logic that follows. Check Point's description ties the flaw specifically to validation of certificate data in the negotiation flow, and the outcome is arbitrary code execution rather than merely authentication bypass.

The attack characteristics are the worst case for a perimeter device. No credentials are required, no user interaction is involved, and the CVSS attack complexity is Low, meaning there is no race or target-specific grooming to get right. The attacker needs only network reach to the VPN service, and no chaining with a second CVE.

Check Point's observed attacks used certificates whose subjects included values such as CN=vpn,OU=users,O=global and close variants, with traffic arriving from commercial VPN and proxy infrastructure. Those subject strings are a usable, if weak, detection signal.

Discovery

Check Point discovered CVE-2026-85102 and the related CVE-2026-85103 internally through its own product security work. No outside researcher or research team has been credited, and no proof-of-concept code has appeared publicly. The company acted as CNA, publishing the advisory and the fixes together on 2026-09-09.

Exploitation Context

Exploitation attempts began on 2026-09-12 and are aimed at Spark Firewall customers globally, per Check Point's 2026-09-22 advisory. That timing is the familiar patch-to-exploit pattern for edge appliances: the fix and its advisory give an attacker with reversing capability a map of the vulnerable code, and small-office appliances are the slowest population to update.

Check Point tells administrators to review logs for anomalous certificate-based Mobile Access logins and for internal scanning originating from accounts that should not be scanning, which indicates post-exploitation activity has been seen moving inward from compromised gateways. No threat actor has been named, no victim count or sector has been published, and no exposure figure from Shadowserver or Censys specific to this CVE has been released. CISA does not flag the CVE as used in ransomware campaigns.

Remediation

1. Install the fixed Jumbo Hotfix Accumulator for your branch: Take 44 on R82.10, Take 126 on R82, Take 166 on R81.20, or Take 190 on R81.10.
2. Confirm LivePatch status rather than assuming coverage. Customers with LivePatch enabled received the protection automatically starting 2026-09-09, but note that LivePatch is version-specific and does not cover every Check Point CVE; verify the gateway actually took it.
3. Update Spark Firewalls to R82.00.10 Build 2325 or R81.10.17 Build 4968. Locally managed Spark appliances are the population under active attack and are not covered by the policy-based workarounds below.
4. If patching must wait on a change window, apply the vendor workaround. For Site-to-Site VPN, disable the implied VPN rules and write explicit rules permitting UDP/500 and UDP/4500 only from known peer addresses. For Remote Access VPN, disable implied rules and permit UDP/500, UDP/4500, TCP/443 and TCP/80 only from the client address ranges you expect. Check Point warns that both changes can break connectivity if scoped carelessly.
5. Upgrade any gateway on R80 through R81. Those releases are out of support and no hotfix exists.
6. Review VPN and Mobile Access logs back to 2026-09-09 for certificate-based logins with subjects such as CN=vpn,OU=users,O=global, for connections sourced from commercial VPN or proxy ranges, and for internal scanning by accounts that do not normally generate it.
7. Treat any gateway suspected of compromise as holding attacker-known secrets: rotate administrative credentials, certificates, and pre-shared keys, and compare the running configuration against a known-good baseline.
8. Federal civilian agencies were required to remediate by 2026-09-25 under BOD 26-04. The three-day window reflects confirmed exploitation of an internet-facing device; everyone else should treat that date as the target.