CVE-2026-85102 & CVE-2026-85103 | Arctic Wolf
Two critical CVSS 9.8 vulnerabilities in Check Point VPN appliances enable unauthenticated remote code execution; patch immediately via LivePatch or Jumbo Hotfix. CVE-2026-85102 (improper certificate validation) and CVE-2026-85103 (heap overflow in ASN.1 decoding) allow unauthenticated RCE on Check Point Security Gateway, Management Server, and Spark Firewall. All R80–R82.10 deployments with exposed VPN services are at risk. No active exploitation observed yet.
Detection / Hunteropenrouter
Immediate Actions
- Apply LivePatch Take 24 or later on all gateways and management servers
- If LivePatch unavailable, install Jumbo Hotfix: R80 Take 166+, R82 Take 126+, R81.10 Take 44+
- Disable implied VPN rules and restrict IKE/IPsec to known peer IPs only
- Validate patch status on all internet-facing appliances
Key Takeaways
- Both CVEs rated CVSS 9.8: network exploitable, no user interaction, no privileges required
- Patches available via LivePatch Take 24+ or Jumbo Hotfix accumulators per version
- No reliable workaround exists for Remote Access VPN or Spark Firewall configurations
- Disable implied VPN rules and restrict IKE/IPsec to known peer IPs as temporary measure
- CERT-EU and Dutch NCSC assess exploitation attempts expected soon
Attack Chain
- Initial Access: Attacker targets internet-facing Check Point VPN service on UDP/500 or UDP/4500
- Exploitation: CVE-2026-85102 or CVE-2026-85103 triggered during VPN negotiation or certificate processing
- Execution: Heap overflow or cert validation bypass achieves unauthenticated remote code execution
- Impact: Full control over targeted appliance enables persistence, lateral movement, and data access
Affected Systems
- Check Point Security Gateway R80–R82.10
- Check Point Management Server
- Check Point Spark Firewall
- Remote Access VPN deployments
- Site-to-Site VPN deployments
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-85102 | Check Point Security Gateway and Spark Firewall | Critical (CVSS 9.8) | Improper certificate validation during VPN negotiation enables unauthenticated RCE. |
| CVE-2026-85103 | Check Point Security Gateway, Management Server, Spark Firewall | Critical (CVSS 9.8) | Heap overflow in ASN.1 certificate decoding enables unauthenticated RCE. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | EDR agents typically absent on VPN gateway appliances; no endpoint telemetry from affected devices. |
| Network Visibility | Medium | VPN negotiation traffic on UDP/500 and UDP/4500 is observable but exploitation within protocol is hard to distinguish. |
| Detection Difficulty | Hard | Exploitation occurs during normal VPN protocol negotiation; distinguishing malicious from benign traffic is challenging. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Hunt for anomalous VPN negotiation failures or unexpected certificate errors on Check Point appliances (T1190). | Check Point VPN and IKE/IPsec logs | Initial Access | Medium — cert errors occur during normal misconfigurations |
| Hunt for unexpected process execution or configuration changes on VPN gateways following negotiation attempts (T1190). | Check Point appliance audit and system logs | Execution | Low — config changes outside maintenance windows are suspicious |
Required Log Sources
- Check Point gateway logs
- VPN negotiation logs
- Firewall traffic logs
- SIEM correlation alerts
Key Behavioral Indicators
- Unexpected VPN negotiation attempts from non-trusted peer IPs
- Abnormal IKE/IPsec traffic patterns on UDP/500 or UDP/4500
- Configuration changes or new admin sessions on VPN appliances
- VPN service restarts or crashes following negotiation attempts
Control Gaps
- Network IPS may not detect exploitation within VPN negotiation payloads
- EDR agents typically absent on VPN gateway appliances
- Certificate validation bypass may not generate distinctive log entries
False Positive Assessment
Low — Detection focuses on patching status and anomalous VPN negotiation patterns; legitimate VPN traffic is well-characterized.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict management interfaces to trusted networks only
- Enforce network segmentation between VPN infrastructure and critical networks
- Migrate from IKEv1 to IKEv2 with strong cryptographic standards
- Enable Secure Configuration Verification for VPN clients
User Protection
- Ensure all remote access VPN clients connect through patched gateways
- Monitor for unexpected VPN session activity
MITRE ATT&CK Mapping
Initial Access
Plain-Language Summary
Two critical security flaws in Check Point VPN firewall products let attackers take full control without needing a password. Any organization using Check Point Security Gateway, Management Server, or Spark Firewall versions R80 through R82.10 with internet-facing VPN is vulnerable. Apply vendor patches immediately via LivePatch or Jumbo Hotfix; there is no reliable workaround for remote access VPN.
- cveCVE-2026-85102Improper certificate validation during VPN negotiation enables unauthenticated RCE.
- cveCVE-2026-85103Heap overflow in ASN.1 certificate decoding enables unauthenticated RCE.