Check Point CVE-2026-85102: Pre-Auth RCE via VPN Cert Validation Bug with LivePatch Fix

CVE-2026-85102 Key Vulnerability Information Summary Vulnerability Overview Vulnerability Name: CVE-2026-85102 — Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN Vulnerability ID: sk1000117 Technical Severity: Basic Security Alert: Critical Last Modified Date: 2026-09-09 Scope of Impact Affected Products: Security Gateway, Spark Firewall (Centrally Managed), Spark Firewall (Locally Managed) Affected Versions: - R81.10 E0SL, R81.10 X, R81.10 X, R81.20, R82.00 X, R82.00 X, R81.10 X, R82.10 - R60, R60.10, R80.20, R80.30, R80.40, R81.10 Lati E0SL - R81.10 X, R82.00 X Unaffected Version: R82.20 Symptoms: Improper validation of certificate data during VPN negotiation may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway. Remediation Mitigations For site-to-site VPNs, disable implicit rules for the VPN and manually define VPN access for UDP/500 and UDP/4500 for specific peer IP addresses. Note: This mitigation option does not apply to locally managed Spark Firewalls. Resolutions The issue has been fixed. Option 1: The fix is included in Check Point LivePatch Automatic Installation: If automatic installation of Check Point LivePatch is enabled, the protection will be applied automatically. Manual Installation: Download the offline package from the table below: Verify that LivePatch is correctly installed and active: In Expert mode, run the command on the Security Gateway / ClusterXL member and verify the presence of . Example Code Block: LivePatch Verification (Expert Mode): Run on the Security Gateway / ClusterXL member. Run on the Scalable Platform Security Group. Expected Output: Option 2: The fix is also included in the following versions: Jumbo Hotfix Accumulator for R82.10 (from Take 44 onwards) Jumbo Hotfix Accumulator for R82 (from Take 126 onwards) Jumbo Hotfix Accumulator for R81.20 (from Take 164 onwards) Check Point Spark Firewalls R82.0.10 (from Build 2325 onwards) Check Point Spark Firewalls R81.10.17 (from Build 4968 onwards)

Goal Reached Thanks to every supporter — we hit 100%!

Check Point CVE-2026-85102: Pre-Auth RCE via VPN Cert Validation Bug with LivePatch Fix