Check Point has disclosed two critical vulnerabilities in its VPN technology that could allow unauthenticated remote attackers to achieve remote code execution (RCE) under specific conditions.
Tracked as CVE-2026-85102 and CVE-2026-85103, the flaws affect Remote Access VPN and Site-to-Site VPN deployments. The company said its internal research team discovered and remediated both issues and that it currently has no indication they are being exploited in the wild.
The vulnerabilities present a significant risk because internet-facing VPN gateways are commonly used to provide remote connectivity into enterprise networks.
Critical Check Point VPN Flaws
Successful exploitation could give an attacker a foothold at the network perimeter without requiring valid credentials, potentially enabling further lateral movement, credential theft, data exfiltration, or ransomware deployment.
CVE-2026-85102 is described as an authentication bypass and remote code execution vulnerability affecting Check Point Remote Access and Site-to-Site VPN functionality.
An authentication bypass weakness can allow an attacker to circumvent controls intended to verify a user or system before granting access to protected services.
When paired with an RCE condition, the impact can be severe: an unauthenticated attacker may be able to execute code on the vulnerable security gateway without first obtaining a VPN username, password, certificate, or multifactor authentication approval.
Check Point has not publicly disclosed complete technical exploit details, attack prerequisites, affected versions, or proof-of-concept code. This limited disclosure likely gives customers time to apply remediation before attackers develop reliable exploitation methods.
The second issue, CVE-2026-85103, is an ASN.1 decoding heap overflow that can also lead to remote code execution.
ASN.1, or Abstract Syntax Notation One, is a data-formatting standard frequently used in cryptographic protocols, certificates, and network communications.
A heap overflow occurs when software writes more data into a dynamically allocated memory area than it can hold. Attackers may corrupt memory and redirect program execution by supplying specially crafted input to a vulnerable ASN.1 parser.
In VPN infrastructure, malformed protocol data or certificate-related objects could trigger this condition. Exploitation reliability may vary based on the affected platform, software version, memory protections, and configuration.
Patch
Check Point strongly recommends that customers install the latest Jumbo Hotfix for their deployed version as soon as it becomes available.
Organizations should identify all externally accessible Check Point Security Gateways, confirm whether Remote Access VPN or Site-to-Site VPN services are enabled, and prioritize patching exposed appliances.
Customers using Check Point Live Patch will receive automatic protection as the rollout begins September 9, 2026. Organizations not using Live Patch should review Check Point knowledge base article sk185114 for deployment guidance.
Security teams should also monitor VPN gateway logs for anomalous unauthenticated connection attempts, unexpected crashes, configuration changes, and suspicious administrative activity.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
 under specific conditions.){kind=link}