# Check Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway

Source: https://startwithidentity.com/cves/cve-2026-85102/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

## What broke

CVE-2026-85102 is improper certificate validation (CWE-295) during VPN negotiation on Check Point Security Gateway and Spark Firewall, for both Remote Access and Site-to-Site VPN. Check Point's own advisory title calls it authentication bypass and remote code execution: an unauthenticated attacker presents crafted certificate data and runs code on the gateway. CVSS 3.1 is 9.8. Affected lines include R81.10.x, R81.20, R82, R82.00.x and R82.10, plus end-of-support R81 and R81.10.

Check Point shipped fixes on September 9, 2026 with no evidence of exploitation. From September 12 it saw a wave of attempts against Spark customers from VPN and proxy infrastructure, using certificates with subjects such as `CN=vpn,OU=users,O=global`. It published an action-required advisory on September 22, and CISA added the CVE to KEV the same day.

## Why it matters

Certificate authentication is supposed to be the stronger option for remote access. Here the code that checks the certificate is the attack surface: the gateway parses an untrusted certificate before it has decided who you are. Check Point says follow-on activity came from attacker sessions logged in through Mobile Access, which then scanned internal ports and services. Thirteen days from fix to KEV is the patch window attackers now give edge VPNs.

## What to do

- Install the fix in sk1000117 for your version. If you run end-of-support R81 or R81.10, upgrade.
- Hunt for certificate-based Mobile Access logins you cannot attribute, and do not stop at the three published subjects.
- Look for internal scanning that starts from VPN-assigned addresses after September 9.

## After you patch

- Reissue VPN client certificates and review which CAs the gateway trusts for user authentication.
- Rotate any directory bind account and RADIUS secrets the gateway holds.
- Check the same management estate for CVE-2026-93616, the pre-authentication management flaw Check Point disclosed in the same advisory.

## Sources

- [NVD: CVE-2026-85102](https://nvd.nist.gov/vuln/detail/cve-2026-85102)
- [Check Point sk1000117](https://support.checkpoint.com/results/sk/sk1000117)
- [Check Point advisory blog, September 22, 2026](https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/)
- [CISA Known Exploited Vulnerabilities catalog, added September 22, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102)