Check Point Multiple Products Improper Certificate Validation Vulnerability
TL;DR 📌
- Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
- Highest CVSS: 9.8 (Critical).
- Listed in CISA KEV (2026-09-22) — this is being exploited in the wild.
- Check the advisory for fixed releases — remediation detail is in the vendor link below.
- CVEs: CVE-2026-85102.
What it is
CVE-2026-85102 is an improper certificate validation flaw in Check Point Security Gateway and Check Point Spark Firewall, triggered during VPN negotiation. Both Site-to-Site VPN and Remote Access VPN configurations are affected.
The problem sits in how the Gateway validates certificate trust during the VPN handshake. Because the check is improper, an attacker does not need valid credentials, a certificate signed by a trusted CA, or any prior access to the device. The attack path is unauthenticated and over the network, reaching the VPN negotiation process directly.
A successful attack results in arbitrary code execution on the Gateway itself — not just a bypass of authentication or a denial of service. Given the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw requires low attack complexity, no privileges, and no user interaction, and impacts confidentiality, integrity, and availability fully.
This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalogue, added on 2026-09-22, so it is known to be exploited.
What to do
- Check the affected Gateways for exposed VPN endpoints (Site-to-Site or Remote Access) reachable from untrusted networks and restrict where operationally possible while remediation is planned.
- Consult the Check Point advisory directly for fixed releases and hotfixes — specific fixed version numbers were not included in the available facts, so do not assume any particular build is safe without checking the vendor page.
- Given the KEV listing, treat this as an active exploitation risk and prioritise patching or mitigation ahead of routine change windows.
- Review Gateway logs for anomalous VPN negotiation attempts or certificate validation failures as a stopgap while a fix is applied.
- After patching, verify certificate trust chains used for VPN negotiation are being enforced as expected, rather than relying solely on the presence of a patch.
For leadership 🧭
Executive summary. Any Check Point Security Gateway or Spark Firewall running Site-to-Site or Remote Access VPN can be taken over by an attacker with no credentials and no prior access, simply by reaching the VPN negotiation process. This is already listed as actively exploited, so it needs to be treated as an emergency, not scheduled into a routine change window.
Why it matters:
- The flaw sits in the Gateway’s certificate trust check during VPN negotiation, meaning both Site-to-Site and Remote Access VPN configurations expose the vulnerable code path directly to the network.
- Exploitation requires no authentication, no valid or CA-signed certificate, and no user interaction, and it leads to arbitrary code execution on the Gateway rather than a lesser bypass or crash.
- Because the Gateway typically sits at the network perimeter, code execution there gives an attacker a foothold with visibility into and control over traffic crossing the VPN boundary.
- The vulnerability is in CISA’s Known Exploited Vulnerabilities catalogue, confirming it is being used in the wild rather than being a theoretical weakness.
Now / Next / Later:
- Now: Identify every Check Point Security Gateway and Spark Firewall with Site-to-Site or Remote Access VPN exposed to untrusted networks and restrict reachability wherever operationally possible while a fix is arranged.
- Next: Apply the fixed release or hotfix from the Check Point advisory to all affected Gateways ahead of routine change windows, given the confirmed active exploitation.
- Later: Build in a post-patch check that certificate trust chains for VPN negotiation are actually being enforced, plus routine log review for anomalous VPN negotiation or certificate validation failures on perimeter Gateways.