Unauthenticated RCE via VPN certificate handling in Check Point products
CVSS 9.8 critical: unauthenticated RCE via VPN certificate handling in Check Point firewall and management products. Check Point released patches September 2026.
- Vendor
- Check Point
- Product
- Check Point firewall and management products
- CVSS
- 9.8
- EPSS (exploit probability)
- 54.1%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-85102 being exploited?
Yes. CISA added CVE-2026-85102 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in ENISA's EU Vulnerability Database (EUVD) exploited list and CIRCL's KEV catalog.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 54.1% (scored October 25, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ LISTED ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-85102 timeline
- Published to NVD
- First 0dayNews coverage+2d
- Added to CISA KEV+13d
- Added to EU KEV (ENISA)+13d
- Added to CIRCL KEV+19d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
An unauthenticated remote code execution vulnerability in Check Point’s VPN certificate processing logic. CVSS 9.8 critical. An attacker with network access to the affected interface can execute code on the device without credentials and without user interaction.
Affected products
Check Point firewall and management products that process VPN certificates. Consult Check Point’s security advisory for specific affected versions and fix builds for your product branch.
Mitigation
Apply Check Point’s patch. If immediate patching is not possible, restrict network access to management interfaces to known administrative hosts to reduce exposure.
This CVE was disclosed alongside CVE-2026-85103, a companion flaw with the same CVSS score and attack class in the same product family. Treat both as a single remediation priority.
For full coverage, see Check Point Patches Two CVSS 9.8 VPN RCE Flaws.
Other Check Point CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-93616 Check Point Multiple Products Path Traversal Vulnerabilitywrite-up | [ CRITICAL ] | 9.8 | 91.6% | |
| CVE-2026-91843 Stack overflow in login handler allows unauthenticated RCE as rootwrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-85103 Unauthenticated RCE via VPN certificate handling in Check Point productswrite-up | [ CRITICAL ] | 9.8 | 4.3% | — |
| CVE-2026-16232 Check Point SmartConsole improper authenticationwrite-up | [ CRITICAL ] | 9.1 | 3.5% | |
| CVE-2026-50751 Check Point Security Gateway Improper Authentication Vulnerabilityransomware use | [ CRITICAL ] | 9.3 | 85.3% | |
| CVE-2024-24919 Check Point Quantum Security Gateways Information Disclosure Vulnerabilityransomware use | [ HIGH ] | 8.6 | 100.0% |
