Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE
Summary: Check Point patched two VPN certificate vulnerabilities, CVE-2026-85102 (a failure to validate certificate trust during VPN negotiation) and CVE-2026-85103 (a heap-based buffer overflow in ASN.1 certificate decoding), both rated CVSS 9.8 and both potentially allowing an unauthenticated remote attacker to run code under conditions the company has not described. Check Point disclosed the flaws on September 9 and began delivering fixes the same day, saying it found both itself and has no indication either was used in an attack.
What's compelling: Customers running R81.10 reported in Check Point's own thread that no Jumbo Hotfix and no Live Patch was available for that branch, leaving a vague mitigation as their only option, while five separate accounts said the automatic rollout had not reached their gateways. A 9.8 unauthenticated RCE in the firewall and management console is the same component class CISA flagged as exploited in June and July, and Check Point has published no indicators of compromise for either new flaw.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-85102CVE-2026-85103
- Related
- ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, Paper Cut Attacks, AI Espionage, and Rootkits Cyber Risks ·CVE-2026-85102: Check Point Multiple Products Improper Certificate Validation Vulnerability Known Exploited Vulnerabilities · Sep 22, 2026