VulnerabilitiesSep 10, 2026

Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE

Check Point discloses two critical VPN certificate flaws with CVSS 9.8, enabling unauthenticated RCE.

Check Point has patched two critical vulnerabilities, CVE-2026-85102 and CVE-2026-85103, in its firewall and management products that could allow unauthenticated remote attackers to execute code. Both flaws have a CVSS score of 9.8 and affect specific versions of Check Point's Quantum Security Gateways and Management Servers. While Check Point states it discovered the flaws internally and has no indication of active exploitation, customers are advised to apply fixes via Live Patch or Jumbo Hotfix.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Check Point?

Get an email when a new story names Check Point, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

Two critical vulnerabilities (CVE-2026-85102 and CVE-2026-85103) in Check Point's Quantum Security Gateways and Management Servers expose organizations to unauthenticated remote code execution, earning the maximum-tier CVSS score of 9.8. Because these flaws reside in VPN certificate handling on perimeter security devices, a successful exploit would give attackers a foothold at the outermost layer of network defense — the very systems designed to stop them. The absence of confirmed active exploitation does not reduce urgency; historically, public disclosure of high-severity VPN flaws triggers rapid weaponization within days. This incident highlights how even purpose-built security appliances are vulnerable software systems requiring continuous patch discipline and proactive vulnerability tracking.

What helps against this

How we list vendors

Check Point research, affected

Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
For exampleTenable Vulnerability Management Axonius Exposures Holm Security Platform all options
Automated patch management
Known holes get closed in days, not months.
For exampleQualys Patch Management NinjaOne Patch Management ManageEngine Patch Manager Plus all options
Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
For exampleReliaQuest GreyMatter Digital Risk Protection Dataminr Threat Intelligence Defused TF all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

cve — CVE-2026-85102
cve — CVE-2026-85103

Entities

Check Point (vendor)Security Gateway (product)Security Management Server (product)Spark Firewall (product)Quantum Security Gateway (product)Quantum Security Management (product)