Check Point Critical VPN RCE Vulnerabilities Disclosure

Check Point has disclosed two critical security vulnerabilities (CVE-2026-85102 and CVE-2026-85103) affecting its Quantum Security Gateways and Security Management Servers. Both flaws carry a CVSS score of 9.8 and allow for unauthenticated remote code execution (RCE). While Check Point states there is no current evidence of active exploitation, the severity and location of these flaws in VPN certificate handling components make them high-priority targets for threat actors.

The technical root causes involve a failure to properly validate certificate trust during VPN negotiation and a heap-based buffer overflow during the decoding of ASN.1 structures in certificates. These issues can potentially be triggered even in environments where the VPN software blade is disabled, provided VPN certificates are present on the system. Affected versions include R81.20, R82, and R82.10 branches with specific Jumbo Hotfix levels.

Immediate action is required for organizations using Check Point infrastructure. Organizations should prioritize the installation of the latest Jumbo Hotfix or verify that the Check Point Live Patch has automatically applied the necessary fixes. The lack of detailed public mitigation steps for older branches like R81.10 underscores the urgency of upgrading or applying official patches to prevent potential RCE attacks.