CVE-2026-85102Check Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
What broke
CVE-2026-85102 is improper certificate validation (CWE-295) during VPN negotiation on Check Point Security Gateway and Spark Firewall, for both Remote Access and Site-to-Site VPN. Check Point's own advisory title calls it authentication bypass and remote code execution: an unauthenticated attacker presents crafted certificate data and runs code on the gateway. CVSS 3.1 is 9.8. Affected lines include R81.10.x, R81.20, R82, R82.00.x and R82.10, plus end-of-support R81 and R81.10.
Check Point shipped fixes on September 9, 2026 with no evidence of exploitation. From September 12 it saw a wave of attempts against Spark customers from VPN and proxy infrastructure, using certificates with subjects such as CN=vpn,OU=users,O=global. It published an action-required advisory on September 22, and CISA added the CVE to KEV the same day.
Why it matters
Certificate authentication is supposed to be the stronger option for remote access. Here the code that checks the certificate is the attack surface: the gateway parses an untrusted certificate before it has decided who you are. Check Point says follow-on activity came from attacker sessions logged in through Mobile Access, which then scanned internal ports and services. Thirteen days from fix to KEV is the patch window attackers now give edge VPNs.
What to do
- Install the fix in sk1000117 for your version. If you run end-of-support R81 or R81.10, upgrade.
- Hunt for certificate-based Mobile Access logins you cannot attribute, and do not stop at the three published subjects.
- Look for internal scanning that starts from VPN-assigned addresses after September 9.
After you patch
- Reissue VPN client certificates and review which CAs the gateway trusts for user authentication.
- Rotate any directory bind account and RADIUS secrets the gateway holds.
- Check the same management estate for CVE-2026-93616, the pre-authentication management flaw Check Point disclosed in the same advisory.
Sources
Related identity CVEs
- CVE-2026-104935Ivanti Connect Secure authentication bypass by spoofed header, exploited as a zero-day
- CVE-2026-16232Check Point SmartConsole login hands an unauthenticated attacker an admin token
- CVE-2026-50751Check Point Remote Access VPN lets attackers in without a password over IKEv1
- CVE-2024-24919Check Point Security Gateway information disclosure of password hashes
Related on Start with Identity
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo
- CVECheck Point Security Gateway information disclosure of password hashes
An unauthenticated read on Check Point Security Gateways leaked password hashes, including those used for VPN and local admin. CISA KEV. May 2024. Hash disclosu
- CVEIvanti Connect Secure authentication bypass
Connect Secure and Policy Secure skipped authentication on a path that later chained with CVE-2024-21887 for unauthenticated RCE. CISA KEV. January 2024 disclos
- BlogRemote access appliances are credential vaults, so patch day has to be rotation day
Four October disclosures about BeyondTrust, Ivanti and Fortinet gateways all ended the same way: the attacker left with the credentials the box was holding. A p
- BlogPEERSTITCH implant tags FortiOS VPN sessions to skip security checks
Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with C
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the