CVE-2026-85102 is a critical vulnerability in Check Point Security Gateway and Spark Firewall caused by a failure to properly validate certificate trust during VPN negotiation. It allows an unauthenticated remote attacker to execute code on the Security Gateway. CVSS score: 9.8 (Critical). It was disclosed alongside a companion heap-based buffer overflow in certificate decoding, CVE-2026-85103, of similar severity, which is not covered by this advisory.

The following Check Point Security Gateway and Spark Firewall versions are affected:

• R82.10 with Jumbo Hotfix Take 43 or lower
• R82 with Jumbo Hotfix Take 125 or lower
• R81.20 with Jumbo Hotfix Take 165 or lower

Not affected / patched version:

• Devices updated via Check Point's automatic Live Patch (rollout began 9 September 2026), or updated to the latest Jumbo Hotfix Take for your deployed version, addressing CVE-2026-85102

Successful exploitation may allow attackers to:

• Execute arbitrary code on the Security Gateway or Spark Firewall without any authentication, by exploiting improper certificate trust validation during VPN negotiation
• Compromise a perimeter VPN gateway, potentially exposing all traffic and remote-access sessions passing through it
• Use a compromised gateway as a foothold for further movement into the internal network it protects

CERTVU recommends the following:

1. Apply the vendor fix as an emergency change

   Confirm Check Point's Live Patch has applied automatically, or manually apply the latest Jumbo Hotfix Take for your version, without delay given confirmed active exploitation.

2. Apply the interim workaround if patching is delayed

   Where immediate patching is not possible, disable VPN implied rules as an interim compensating control; confirm the exact configuration steps with Check Point support, as published guidance on this point has been described as non-specific.

3. Treat this as top priority