Remote Code Execution Vulnerability in Check Point VPN Gateways

Catalog analysis: CISA added this entry on September 22, 2026. The entry reflects catalog information retrieved on September 23, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-85102 is an improper certificate validation vulnerability (CWE-295) affecting specific Check Point networking products. This flaw could allow an unauthenticated remote attacker to execute arbitrary code on the affected gateway. Due to the nature of the vulnerability, it has been added to CISA’s Known Exploited Vulnerabilities catalog as of September 22, 2026.

Exposure and applicability

This vulnerability specifically applies to Check Point Security Gateways and Check Point Spark Firewalls that are configured to use Site-to-Site VPN or Remote Access VPN.

For U.S. healthcare providers and business associates, these devices often serve as the primary secure perimeter for remote clinical access and the encrypted transmission of electronic Protected Health Information (ePHI) between facilities. An attacker successfully exploiting this flaw could potentially gain unauthorized entry into the internal healthcare network, bypassing traditional perimeter defenses.

Remediation priorities

Based on our analysis, organizations should prioritize the following actions to reduce risk:

1. Inventory and Identification: Network administrators should immediately identify all Check Point Security Gateways and Spark Firewalls in use and determine if they are utilizing Site-to-Site or Remote Access VPN functions.
2. Vendor Mitigation Application: Apply the mitigations provided by Check Point according to their official instructions. This is the primary method for addressing the improper certificate validation flaw.
3. Forensic Triage: Because this vulnerability is listed as known to be exploited, security teams should perform forensic triage on affected gateways to identify signs of unauthorized access or arbitrary code execution prior to patching.

How to validate remediation

To verify that exposure has been reduced, we recommend the following checkpoints:

• Configuration Audit: Confirm through administrative consoles that the specific mitigations recommended by the vendor have been applied to all identified VPN gateways.
• Version Verification: Ensure that the current firmware or patch level matches the vendor’s requirements for resolving CVE-2026-85102.
• Log Review: Coordinate with security operations to review gateway logs for anomalies that may indicate attempted exploitation of the certificate validation process.

Limits and open questions

While applying vendor mitigations could reduce the likelihood of exploitation, it is not a guarantee of total prevention. There are several remaining unknowns:

• Exploitation History: It is currently unknown if this vulnerability has been utilized in ransomware campaigns.
• Residual Risk: The extent to which other configuration settings might interact with this flaw remains unclear; therefore, organizations should maintain a defense-in-depth posture.
• Scope of Impact: This analysis is limited to devices using the specified VPN functions; the impact on Check Point products not utilizing these specific VPN configurations is not addressed in the current advisory.

Source and editorial note

CVE-2026-85102: Check Point Multiple Products Improper Certificate Validation Vulnerability · Source date: September 22, 2026 · Retrieved September 23, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a healthcare security assessment