Critical unauthenticated RCE flaws in Check Point VPN
NCSC-NL warns of two critical CVSS 9.8 flaws in Check Point Quantum Security Gateway and Spark Firewall VPNs allowing unauthenticated remote code execution, with mass exploitation expected soon.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-85102 as exploited in the wild.
NCSC-NL published a high-priority advisory covering two critical vulnerabilities in Check Point VPN products. CVE-2026-85102 is an improper certificate validation flaw in the VPN negotiation process of the Quantum Security Gateway, allowing an unauthenticated remote attacker to bypass authentication controls and execute arbitrary code during VPN negotiation due to insufficient validation of certificate trust. CVE-2026-85103 is a heap-based buffer overflow in the ASN.1 decoding of VPN certificates, caused by improper handling of ASN.1 data structures during certificate processing, also enabling unauthenticated remote code execution. Both vulnerabilities carry a CVSS score of 9.8 and affect Security Gateway and Check Point Spark Firewall when Site-to-Site VPN or Remote Access VPN is enabled.
NCSC-NL explicitly states it expects large-scale exploitation attempts in the near term and urges organizations to apply Check Point's advisory and updates urgently. Check Point has released patches for both issues. As an interim mitigation for Site-to-Site VPN deployments, Check Point recommends disabling implied rules for VPN and explicitly restricting VPN access on UDP/500 and UDP/4500 to specific peer IP addresses; this mitigation does not apply to locally managed Spark Firewalls, which have no equivalent workaround and require patching.
Defenders running Check Point Quantum Security Gateway or Spark Firewall with Site-to-Site or Remote Access VPN enabled should prioritize immediate patching, review exposure of UDP/500 and UDP/4500, and monitor VPN gateways for anomalous negotiation traffic or crash/restart patterns that could indicate exploitation attempts targeting the ASN.1 certificate parsing path.
Mentioned in this report
Detection guidance
Check Point VPN Gateway ASN.1 Certificate Parsing Crash or Restart
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects Check Point Security Gateway or Spark Firewall process crash/restart cycles correlated with inbound UDP/500 or UDP/4500 traffic, indicative of ASN.1 buffer overflow exploitation attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Check Point VPN Gateway ASN.1 Certificate Parsing Crash or Restart
description: Detects repeated process termination and restart of Check Point Security
Gateway (cpd, fw1) or Spark Firewall services correlated with VPN negotiation traffic
on UDP/500 (IKE) or UDP/4500 (IPsec NAT-T), suggestive of ASN.1 heap buffer overflow
exploitation.
tags:
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_cpd_restart:
Image|endswith:
- \cpd.exe
- \fw1.exe
selection_restart_pattern:
CommandLine|contains:
- restart
- reboot
filter_legitimate_maintenance:
CommandLine|contains:
- scheduled
- maintenance
- policy
- update
condition: selection_cpd_restart and selection_restart_pattern and not filter_legitimate_maintenance
falsepositives:
- Legitimate Check Point policy updates or gateway reboot cycles scheduled by administrators
- Automated failover or high-availability cluster state transitions
level: medium
id: 8a39767e-3e0e-5bf4-b25d-c67dec57bbd8
status: experimental
author: Vorant
Anomalous VPN Certificate Processing via Certificate Validation Bypass
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects unusual certificate chain validation or trust store access patterns in Check Point VPN processes, indicative of CVE-2026-85102 improper certificate validation exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Anomalous VPN Certificate Processing via Certificate Validation Bypass
description: Detects access to certificate trust stores or validation bypass indicators
within Check Point Security Gateway VPN negotiation processes (cpd, fw1), consistent
with improper certificate validation flaw (CVE-2026-85102).
tags:
- attack.t1553.002
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection_vpn_process:
ParentImage|endswith:
- \cpd.exe
- \fw1.exe
selection_cert_bypass_indicators:
CommandLine|contains:
- cert
- certificate
- validation
- trust
- verify
selection_suspicious_child:
Image|endswith:
- \certutil.exe
- \openssl.exe
condition: (selection_vpn_process and selection_cert_bypass_indicators) or (selection_vpn_process
and selection_suspicious_child)
falsepositives:
- Check Point certificate renewal or rotation scripts executed during maintenance
windows
- Third-party PKI integration tools validating certificates during normal VPN operations
level: medium
id: dca2ac22-be2c-5bb3-b1b2-510fc0503631
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0365.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs