CVE-2026-85102
Check Point VPN certificate-validation flaw allowing unauthenticated code execution on gateways.
US authorities listed CVE-2026-85102 as exploited on 22 September 2026 with a three-day federal Deadline; it had been used against Check Point Spark firewalls since 12 September, through certificate data sent while a VPN connection is negotiated.
Last refreshed: 12 October 2026
How did a VPN certificate check let attackers into Check Point firewalls?
Timeline for CVE-2026-85102
Mentioned in: Two 9.8 Check Point flaws hit firewalls
Cybersecurity: Threats and DefencesBackground
CVE-2026-85102 is an improper certificate validation flaw in Check Point Quantum Security Gateway and Spark firewalls. Check Point says an attacker with no credentials can use it to run code on a gateway during VPN negotiation, and CISA's entry covers both Site to Site VPN and Remote Access VPN.
Check Point's CVE record, sk1000117, scores it 9.8 under CVSS 3.1. Affected releases are R81.20 up to Jumbo Hotfix Take 165, R82 up to Take 125 and R82.10 up to Take 43.
CISA listed the flaw as exploited on 22 September 2026, setting federal agencies a 25 September deadline. It was the second Check Point VPN flaw exploited in 2026, which puts the company's VPN code among the most targeted parts of its firewalls that year.
A certificate check opened the gateway
Attackers were using CVE-2026-85102 against Spark firewalls from 12 September 2026, according to Check Point. They sent crafted certificate data while a VPN connection was being set up, which let them run code on the gateway without logging in. CISA added the flaw to its exploited list on 22 September and gave federal agencies until 25 September.
For R81.20 the gateway repair is Jumbo Hotfix Take 166, with LivePatch Take 26 as an alternative, while a management-server flaw listed on the same day needed an update of its own. CVE-2026-85102 was Check Point's second exploited VPN flaw of 2026, after a Remote Access VPN authentication bypass in June.