Critical Check Point VPN Flaws Let Unauthenticated Attackers Execute Remote Code

Gbhackers •Divya • September 11, 2026

Check Point has announced two critical vulnerabilities in its VPN technology that could allow unauthenticated remote attackers to execute arbitrary code on affected security gateways under certain conditions. These vulnerabilities, tracked as CVE-2026-85102 and CVE-2026-85103, impact both Remote Access VPN and Site-to-Site VPN functionalities. Check Point said its internal research team discovered and resolved these […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Check Point VPN Vulnerabilities Disclosed and Patched On September 9, 2026, Check Point disclosed two critical vulnerabilities, CVE-2026-85102 and CVE-2026-85103, both with a CVSS score of 9.8, affecting its Quantum product line. These vulnerabilities allow unauthenticated remote code execution through improper certificate trust validation and a heap-based buffer overflow during VPN certificate processing. Affected systems include Security Gateways, Security Management Servers, and Spark Firewalls across multiple versions. Check Point has released emergency patches and recommends immediate application of these fixes. Organizations using Check Point LivePatch are automatically protected, while others must manually install the Jumbo Hotfix. No evidence of active exploitation has been reported as of the disclosure date. However, the nature of the vulnerabilities poses a significant risk if exploited. Organizations are advised to review their systems and apply the necessary updates promptly. 45 sources 74

Extracted Entities

Critical Check Point VPN Flaws Let Unauthenticated Attackers Execute Remote Code

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

Platforms (1)