CVE-2026-85102Check Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
What broke
CVE-2026-85102 is improper certificate validation (CWE-295) during VPN negotiation on Check Point Security Gateway and Spark Firewall, for both Remote Access and Site-to-Site VPN. Check Point's own advisory title calls it authentication bypass and remote code execution: an unauthenticated attacker presents crafted certificate data and runs code on the gateway. CVSS 3.1 is 9.8. Affected lines include R81.10.x, R81.20, R82, R82.00.x and R82.10, plus end-of-support R81 and R81.10.
Check Point shipped fixes on September 9, 2026 with no evidence of exploitation. From September 12 it saw a wave of attempts against Spark customers from VPN and proxy infrastructure, using certificates with subjects such as CN=vpn,OU=users,O=global. It published an action-required advisory on September 22, and CISA added the CVE to KEV the same day.
Why it matters
Certificate authentication is supposed to be the stronger option for remote access. Here the code that checks the certificate is the attack surface: the gateway parses an untrusted certificate before it has decided who you are. Check Point says follow-on activity came from attacker sessions logged in through Mobile Access, which then scanned internal ports and services. Thirteen days from fix to KEV is the patch window attackers now give edge VPNs.
What to do
- Install the fix in sk1000117 for your version. If you run end-of-support R81 or R81.10, upgrade.
- Hunt for certificate-based Mobile Access logins you cannot attribute, and do not stop at the three published subjects.
- Look for internal scanning that starts from VPN-assigned addresses after September 9.
After you patch
- Reissue VPN client certificates and review which CAs the gateway trusts for user authentication.
- Rotate any directory bind account and RADIUS secrets the gateway holds.
- Check the same management estate for CVE-2026-93616, the pre-authentication management flaw Check Point disclosed in the same advisory.
Sources
Related identity CVEs
Related on Start with Identity
- CVECheck Point Security Gateway information disclosure of password hashes
An unauthenticated read on Check Point Security Gateways leaked password hashes, including those used for VPN and local admin. CISA KEV. May 2024. Hash disclosu
- CVEIvanti Connect Secure authentication bypass
Connect Secure and Policy Secure skipped authentication on a path that later chained with CVE-2024-21887 for unauthenticated RCE. CISA KEV. January 2024 disclos
- BlogRemote access appliances are credential vaults, so patch day has to be rotation day
Four October disclosures about BeyondTrust, Ivanti and Fortinet gateways all ended the same way: the attacker left with the credentials the box was holding. A p
- CVECisco ISE API authentication bypass, exploited on the network access control plane
An API endpoint on Cisco Identity Services Engine skipped authentication, letting an unauthenticated attacker past the admin interface and, per Cisco, to root.
- BlogPEERSTITCH implant tags FortiOS VPN sessions to skip security checks
Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with C
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576