- The Mess: Check Point disclosed two critical VPN vulnerabilities affecting Remote Access and Site-to-Site VPN. One is an authentication bypass that can lead to remote code execution.
- The Damage: An attacker may reach the VPN gateway without valid credentials and potentially take control of the security appliance.
- The Fix: Install the latest Jumbo Hotfix for the affected version or ensure Check Point Live Patch has applied the protection.
Check Point has just dropped a nasty pair of vulnerabilities into one of the most sensitive places in an enterprise network: the VPN gateway.
The two flaws are tracked as CVE-2026-85102 and CVE-2026-85103. Check Point describes both as critical and says they can potentially allow unauthenticated remote code execution under specific conditions.
That is exactly the kind of sentence network defenders do not want to read about their perimeter device.
The First Bug Breaks Authentication
CVE-2026-85102 affects Remote Access and Site-to-Site VPN functionality.
The vulnerability is an authentication bypass that can ultimately lead to RCE.
The important word is authentication.
VPN gateways exist specifically to decide who gets access to the network. If an attacker can bypass that decision before establishing a legitimate authenticated session, the security appliance itself becomes the target.
Check Point has assigned the vulnerability its own security advisory, sk1000117. The company recommends applying the latest Jumbo Hotfix for the deployed version.
The Second Bug Is a Heap Overflow
CVE-2026-85103 takes a different route.
Check Point describes it as an ASN.1 decoding heap overflow leading to remote code execution.
ASN.1 is used extensively in security and networking protocols. A memory-corruption flaw in code parsing attacker-controlled protocol data is exactly the sort of bug that can turn a network packet into something much worse.
The advisory is tracked as sk1000118.
Two different bugs.
Two different exploitation paths.
Same perimeter.
No Exploitation — Yet
There is currently an important limitation to the story.
Check Point says the vulnerabilities were discovered internally and that it has no indication of active exploitation.
That means this is not another “attackers are already inside” story.
It is a patch-now story.
And that distinction matters because VPN appliances are continuously exposed by design.
You cannot simply hide the gateway behind another firewall and call the problem solved.
The VPN gateway has to accept Internet traffic.
Check Point Is Using Live Patch
Check Point says customers using Live Patch will be automatically protected as the rollout began on September 9, 2026.
Customers who are not using Live Patch need to follow the remediation instructions and install the appropriate Jumbo Hotfix.
That creates two immediate tasks for administrators:
Check whether the gateway is affected.
Check whether the protection has actually been applied.
Do not assume that “we have automatic updates” means the security fix is already active.
Why VPN Bugs Keep Winning
VPN appliances are attractive because they sit exactly where attackers want to be.
The device is Internet-facing.
It processes complex protocols.
It handles authentication.
It has privileged access to internal networks.
And compromising the gateway can eliminate several security controls at once.
An attacker who owns a workstation still has to move laterally.
An attacker who owns the VPN gateway may start with the front door already open.
That is why a VPN RCE with no authentication requirement deserves immediate attention even without confirmed exploitation.
Bugstoday Opinion
The interesting part of these vulnerabilities is not the CVSS number.
It is the location.
A browser bug compromises a browser.
A VPN gateway bug can compromise the boundary between the Internet and the corporate network.
CVE-2026-85102 attacks authentication.
CVE-2026-85103 attacks protocol parsing.
Neither requires the defender to make a mistake by clicking something.
The good news is that Check Point says it has seen no evidence of exploitation.
The bad news is that this is exactly the sort of vulnerability researchers and attackers will dissect next.
Patch the gateway before somebody turns the advisory into a PoC.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- Check Point — Security Advisory sk1000117
- Check Point — Security Advisory sk1000118
- Check Point CheckMates — Critical Security Advisory
- Check Point — 2026 Security Advisories
