Check Point has addressed two critical flaws in the way its management and firewall products manage VPN certificates. Both vulnerabilities have been assigned a CVSS score of 9.8 out of 10. This makes them one of the most serious flaws impacting the products. The vulnerabilities could permit an unauthorized remote threat actor to run malicious code on compromised devices.
The flaws, tracked as CVE-2026-85103 and CVE-2026-85102, are associated with the validation and processing of digital certificates utilized during VPN connections.
Technical information
The first flaw, CVE-2026-85103, is associated with a heap-based buffer overflow in the VPN certificate data processing. A threat actor may send particularly tailored certificate details to a compromised device and trigger memory corruption.
The second flaw, CVE-2026-85102, is associated with improper verification of certifications during VPN processes. A threat actor could exploit the flaw without getting genuine verification credentials under certain conditions.
The flaws impact Check Point Security Gateways, while the impacted product range also consists of Security Management Server for the related flaw.
The vulnerabilities affect Check Point Security Gateways, while the affected product range also includes Security Management Server for the relevant flaw.
Potential risks
The flaws can have major risks to enterprises that use Check Point Security Gateways to give site-to-site VPN services or remote-access.
An unauthorized attack may be problematic as the threat actor may not need genuine VPN credentials before trying to abuse the vulnerable component. In case of successful exploitation, remote code execution (RCE) could let a threat actor infect the impacted security infrastructure and may use it as a starting point for more compromise inside an enterprise.
But, Check Point has signalled that it has no proof that these flaws have been abused in the wild. Thus, the incident should be looked at as a critical patching issue and not an active exploitation campaign of the flaws.
Addressing the flaws
The security updates offered by Check Point should be applied to organizations immediately. Admins should check Check Point’s security advisory for the particular product variants and related fixes.
Organizations should also keep an eye for Security Gateway systems and VPN for suspicious activity, unusual certificate-related requests, or suspicious connections.
As both flaws have a CVSS score of 9.8, security teams should prioritize restoration, especially for internet-facing VPN infrastructure.
