CVE-2026-85102: Check Point VPN Gateways Fail Certificate Validation, Enabling Unauthenticated RCE
CISA added CVE-2026-85102 to KEV on 2026-09-22 with a 2026-09-25 due date. The Check Point VPN certificate validation flaw allows unauthenticated remote code execution on Security Gateway and Spark Firewall.
CVE-2026-85102: Check Point VPN Gateways Fail Certificate Validation, Enabling Unauthenticated RCE
TL;DR
CVE-2026-85102 is a critical improper certificate validation flaw in Check Point Security Gateway and Check Point Spark Firewall deployments that terminate Site-to-Site or Remote Access VPN tunnels. An unauthenticated remote attacker can exploit the flaw to execute arbitrary code on the gateway. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on 2026-09-22 with a remediation due date of 2026-09-25, so defenders should treat this as an emergency patch and forensic triage event.
What is this vulnerability?
| Field | Detail |
|---|---|
| CVE | CVE-2026-85102 |
| Vendor | Check Point |
| Product | Multiple Products (Security Gateway, Spark Firewall) |
| Vulnerability name | Check Point Multiple Products Improper Certificate Validation Vulnerability |
| Weakness | CWE-295 Improper Certificate Validation |
| CISA KEV added | 2026-09-22 |
| CISA KEV due date | 2026-09-25 |
| Known ransomware use | Unknown |
| Vendor CVSS v3.1 | 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) |
| EPSS | 0.00329 (26.293 percentile) |
Overview
CVE-2026-85102 is a critical improper certificate validation vulnerability affecting Check Point Security Gateway and Check Point Spark Firewall deployments that terminate Site-to-Site VPN or Remote Access VPN tunnels. Check Point's own CVSS v3.1 assessment is 9.8, reflecting that no authentication, user interaction, or special network position is required beyond reachability of the VPN service. The flaw is classified as CWE-295, Improper Certificate Validation, and the vendor's advisory describes the root issue as improper certificate trust validation during VPN negotiation. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2026-09-22 with a remediation due date of 2026-09-25, an unusually short window that signals active exploitation in the wild.
No public proof-of-concept or exploit code is referenced in the source intelligence, but the KEV listing alone should drive emergency change handling. Defenders responsible for internet-facing VPN concentrators, remote-access infrastructure, or inter-site tunnels built on Check Point products should treat this as a top-priority incident-prevention item rather than a routine patch cycle entry. Organizations subject to CISA's BOD 26-04 obligations must also account for the directive's forensic triage requirements when scoping response.
The affected product set spans Check Point Security Gateway and Check Point Spark Firewall. Exact version ranges and hotfix levels are not enumerated in the source intelligence; defenders must consult Check Point SK1000117 for the authoritative product and build matrix. Because the vulnerable component is the VPN negotiation path itself, the trust boundary that is crossed is the perimeter authentication boundary: the gateway treats an unauthenticated remote peer as a legitimate tunnel endpoint. That combination of network reachability, no credentials required, and code execution on a security device is why this CVE warrants immediate attention from both vulnerability management and SOC teams.
Technical details
The vulnerability lives in the certificate trust validation logic used while a Check Point gateway negotiates a VPN tunnel. Under normal operation, the gateway should verify that a peer's certificate chains to a trusted authority, is within its validity window, is not revoked, and is presented by an entity authorized for the requested tunnel. CVE-2026-85102 indicates that this validation can be bypassed or is performed incorrectly, allowing a peer presenting an untrusted, malformed, or otherwise invalid certificate to complete negotiation.
Because the affected component is the VPN negotiation path itself, the trust boundary that is crossed is the perimeter authentication boundary: the gateway treats an unauthenticated remote peer as a legitimate tunnel endpoint. The vendor's summary states the consequence can be arbitrary code execution on the gateway, which implies the negotiation flaw is chained into a memory-safety or command-handling weakness reachable after the tunnel is established or during handshake processing.
Attack prerequisites are minimal:
- Network reachability to the VPN service (IKE, IPsec, or the relevant remote-access listener).
- The ability to present a crafted certificate during negotiation.
- No credentials, no client software trust, and no user interaction are required.
Affected version ranges are not enumerated in the source intelligence; defenders must consult Check Point SK1000117 for the authoritative product and build matrix. The CWE-295 classification places this in the same family as TLS/IPsec trust bypass issues where the fix typically involves stricter chain building, hostname or identity binding, and revocation handling.
Impact
Successful exploitation yields code execution on a security gateway, which is among the most sensitive assets in a network. A compromised gateway can be used to decrypt or manipulate inspected traffic, pivot into protected segments, alter or disable security policy, and tamper with logging.
- Confidentiality: High. VPN concentrators sit in the path of encrypted corporate traffic and hold pre-shared keys, certificates, and private keys.
- Integrity: High. An attacker with code execution can rewrite policy, inject routes, or modify tunnel behavior.
- Availability: High. The same access allows crashing or disabling the gateway, cutting off remote workers and site connectivity.
Downstream abuse scenarios include establishing persistent tunnels for command-and-control, harvesting credentials from remote-access sessions, and using the gateway's trusted network position to reach management planes. Business exposure includes regulatory notification obligations, loss of remote-work capability during containment, and the possibility that the gateway itself becomes the initial access vector for ransomware or extortion operations. The source intelligence marks known ransomware use as unknown, so defenders should not assume the tooling is limited to espionage.
Exploitability
CISA added CVE-2026-85102 to the KEV catalog on 2026-09-22, with a due date of 2026-09-25. That three-day window is a strong signal that exploitation has been observed or is assessed as imminent. The vendor-assigned CVSS v3.1 score is 9.8 (Critical), with a network attack vector, low attack complexity, no privileges required, and no user interaction. The EPSS score is 0.00329, roughly the 26th percentile, which is low relative to the KEV signal; EPSS reflects observed exploitation likelihood in the broader ecosystem and should not override authoritative exploitation evidence such as a KEV listing.
No public proof-of-concept or exploit code is referenced in the source intelligence. However, the absence of public exploit code does not reduce urgency given the KEV designation. Defenders should assume that exploitation is possible with minimal prerequisites and that the attack surface is any internet-reachable Check Point VPN endpoint.
KEV vs CVSS vs EPSS
| Signal | What it measures | Action for this CVE |
|---|---|---|
| CISA KEV | Confirmed exploitation in the wild | Treat as emergency; remediate by 2026-09-25 and perform forensic triage per BOD 26-04 |
| CVSS v3.1 (9.8) | Technical severity of the vulnerability | Prioritize as Critical; unauthenticated network RCE on a perimeter device |
| EPSS (0.00329) | Probability of exploitation activity in the next 30 days | Low relative to KEV; do not use to deprioritize given KEV listing |
Exploitation steps (defensive triage)
- Identify internet-facing Check Point Security Gateway or Spark Firewall instances that terminate Site-to-Site or Remote Access VPN, using asset inventory, external attack-surface scans, and certificate transparency or banner data.
- Confirm the running firmware and hotfix level against Check Point SK1000117 to determine whether the instance is in scope for CVE-2026-85102.
- Review VPN negotiation logs for handshake attempts from unexpected peer identities, unusual certificate subjects, or repeated failures followed by successful tunnel establishment.
- Hunt for tunnel sessions that were established without a corresponding legitimate peer configuration or change ticket.
- Inspect gateway process behavior for unexpected child processes, outbound connections from the gateway itself, or modifications to policy and configuration files.
- Correlate with authentication and management logs to determine whether any post-exploitation access to the management server or other internal systems occurred.
- If compromise is suspected, isolate the gateway, preserve volatile evidence per CISA forensic triage guidance, and rebuild from a known-good image rather than cleaning in place.
- Apply the vendor fix or documented mitigation, then re-verify that only trusted peers can complete VPN negotiation.
Indicators of compromise
- VPN negotiation or IKE logs showing certificate validation warnings, unknown issuer errors, or handshakes completing with peer identities that do not match configured peers.
- Tunnel sessions originating from IP addresses with no corresponding business relationship, especially short-lived sessions that precede configuration changes.
- Unexpected outbound connections from the gateway to internet hosts, particularly on non-standard ports.
- New or modified local accounts, SSH keys, or administrative credentials on the gateway or its management server.
- Changes to firewall policy, VPN community objects, or routing tables that were not tied to an approved change record.
- Gateway process crashes, core dumps, or restarts clustered around VPN negotiation events.
- EDR or host telemetry showing shell, scripting interpreter, or download utility execution spawned by gateway services.
- Log gaps, cleared audit entries, or disabled logging on the gateway and its management components.
Mitigation and workarounds
Check Point's advisory SK1000117 is the authoritative source for fixed builds and hotfixes; apply the vendor-provided update to all in-scope Security Gateway and Spark Firewall instances as the primary remediation. Because CISA's KEV due date is 2026-09-25, treat this as emergency maintenance and prioritize internet-facing VPN endpoints first.
Where immediate patching is not possible, reduce exposure by restricting VPN listener reachability to known peer address ranges, disabling unused VPN communities, and enforcing strong peer identity checks at an upstream device. Monitor for the indicators above continuously during the exposure window.
Organizations under BOD 26-04 should follow the directive's prioritization and forensic triage requirements, including evidence collection expectations, and should evaluate whether cloud-hosted or managed Check Point services are affected. If mitigations cannot be applied and exposure cannot be reduced, CISA guidance permits discontinuing use of the affected capability until a fix is in place.
After remediation, rotate any credentials, certificates, and pre-shared keys that were present on the gateway, and validate that trust validation now rejects untrusted peers.
Community reactions
The listing of CVE-2026-85102 in CISA's KEV catalog on 2026-09-22, with a due date only three days later, drove immediate attention from defenders and vulnerability management teams. The combination of a 9.8 vendor-assigned CVSS score, an unauthenticated network attack vector, and code execution on a perimeter security device makes this an easy case for emergency change boards. Security media and vendor advisories have framed it as a VPN trust bypass with remote code execution consequences, and the absence of public exploit code has not reduced urgency given the KEV designation. Community discussion has centered on the short remediation window, the need to inventory Check Point VPN endpoints that are often managed by network teams rather than endpoint security teams, and the importance of post-patch forensic triage. The EPSS score of 0.00329 (roughly the 26th percentile) is low relative to the KEV signal, a reminder that EPSS reflects observed exploitation likelihood in the broader ecosystem and should not override authoritative exploitation evidence. Defenders should expect follow-up vendor guidance and possible expansion of affected product lists as Check Point completes its analysis.
FAQ
Is CVE-2026-85102 in CISA's KEV catalog? Yes. CISA added it on 2026-09-22.
What is the CISA remediation due date? 2026-09-25.
Is the vulnerability exploitable over the internet? Yes, if the VPN service is reachable. The attack vector is network-based and requires no authentication or user interaction.
Which products are affected? Check Point Security Gateway and Check Point Spark Firewall using Site-to-Site VPN or Remote Access VPN. Consult Check Point SK1000117 for the authoritative product and build matrix.
How do I verify remediation? Confirm the running firmware and hotfix level against Check Point SK1000117, then validate that only trusted peers can complete VPN negotiation. Rotate credentials, certificates, and pre-shared keys after patching.
What should I do if I cannot patch immediately? Restrict VPN listener reachability to known peer address ranges, disable unused VPN communities, enforce strong peer identity checks upstream, and monitor for the indicators of compromise listed above. If mitigations are unavailable, CISA guidance permits discontinuing use of the affected capability.
Related resources
- Check Point Security Advisory SK1000117: https://support.checkpoint.com/results/sk/sk1000117
- CISA BOD 26-04, Prioritizing Security Updates Based on Risk: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- CISA BOD 26-04 Implementation Guidance, Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- NVD entry for CVE-2026-85102: https://nvd.nist.gov/vuln/detail/CVE-2026-85102