Unauthenticated RCE via VPN certificate handling in Check Point products
CVSS 9.8 critical: companion to CVE-2026-85102, a second unauthenticated RCE in Check Point's VPN certificate handling. Patched September 2026.
- Vendor
- Check Point
- Product
- Check Point firewall and management products
- CVSS
- 9.8
- EPSS (exploit probability)
- 4.3%
- Status
- patched
- Published
Is CVE-2026-85103 being exploited?
Yes, per ENISA's EU Vulnerability Database (EUVD) exploited list. It was not on CISA's KEV catalog as of our 2026-11-05 snapshot.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 4.3% (scored October 25, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ LISTED ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-85103 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
An unauthenticated remote code execution vulnerability in Check Point’s VPN certificate processing logic, disclosed alongside CVE-2026-85102. CVSS 9.8 critical. An attacker with network access can execute code on affected devices without credentials and without user interaction.
Affected products
Check Point firewall and management products that process VPN certificates. Consult Check Point’s security advisory for specific affected versions and fix builds for your product branch.
Mitigation
Apply Check Point’s patch. If immediate patching is not possible, restrict management interface access to known administrative hosts.
Both CVE-2026-85103 and CVE-2026-85102 were patched in the same September 2026 advisory. Treat them as a single remediation task.
For full coverage, see Check Point Patches Two CVSS 9.8 VPN RCE Flaws.
Other Check Point CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-93616 Check Point Multiple Products Path Traversal Vulnerabilitywrite-up | [ CRITICAL ] | 9.8 | 91.6% | |
| CVE-2026-85102 Unauthenticated RCE via VPN certificate handling in Check Point productswrite-up | [ CRITICAL ] | 9.8 | 54.1% | |
| CVE-2026-91843 Stack overflow in login handler allows unauthenticated RCE as rootwrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-16232 Check Point SmartConsole improper authenticationwrite-up | [ CRITICAL ] | 9.1 | 3.5% | |
| CVE-2026-50751 Check Point Security Gateway Improper Authentication Vulnerabilityransomware use | [ CRITICAL ] | 9.3 | 85.3% | |
| CVE-2024-24919 Check Point Quantum Security Gateways Information Disclosure Vulnerabilityransomware use | [ HIGH ] | 8.6 | 100.0% |
