# Critical unauthenticated RCE flaws in Check Point VPN

Published: 2026-09-10 · Severity: high · Sectors: infrastructure, government-national, technology
Canonical: https://vorant.io/reports/7a81f694-abb1-54ea-83dd-11e3e9152033/critical-unauthenticated-rce-flaws-in-check-point-vpn

> NCSC-NL warns of two critical CVSS 9.8 flaws in Check Point Quantum Security Gateway and Spark Firewall VPNs allowing unauthenticated remote code execution, with mass exploitation expected soon.

NCSC-NL published a high-priority advisory covering two critical vulnerabilities in Check Point VPN products. CVE-2026-85102 is an improper certificate validation flaw in the VPN negotiation process of the Quantum Security Gateway, allowing an unauthenticated remote attacker to bypass authentication controls and execute arbitrary code during VPN negotiation due to insufficient validation of certificate trust. CVE-2026-85103 is a heap-based buffer overflow in the ASN.1 decoding of VPN certificates, caused by improper handling of ASN.1 data structures during certificate processing, also enabling unauthenticated remote code execution. Both vulnerabilities carry a CVSS score of 9.8 and affect Security Gateway and Check Point Spark Firewall when Site-to-Site VPN or Remote Access VPN is enabled.

NCSC-NL explicitly states it expects large-scale exploitation attempts in the near term and urges organizations to apply Check Point's advisory and updates urgently. Check Point has released patches for both issues. As an interim mitigation for Site-to-Site VPN deployments, Check Point recommends disabling implied rules for VPN and explicitly restricting VPN access on UDP/500 and UDP/4500 to specific peer IP addresses; this mitigation does not apply to locally managed Spark Firewalls, which have no equivalent workaround and require patching.

Defenders running Check Point Quantum Security Gateway or Spark Firewall with Site-to-Site or Remote Access VPN enabled should prioritize immediate patching, review exposure of UDP/500 and UDP/4500, and monitor VPN gateways for anomalous negotiation traffic or crash/restart patterns that could indicate exploitation attempts targeting the ASN.1 certificate parsing path.

## Mentioned in this report

- Vulnerabilities: CVE-2026-85102, CVE-2026-85103

## Detection guidance (public sample)

### Check Point VPN Gateway ASN.1 Certificate Parsing Crash or Restart

ATT&CK: T1190

Detects Check Point Security Gateway or Spark Firewall process crash/restart cycles correlated with inbound UDP/500 or UDP/4500 traffic, indicative of ASN.1 buffer overflow exploitation attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Check Point VPN Gateway ASN.1 Certificate Parsing Crash or Restart
description: Detects repeated process termination and restart of Check Point Security
  Gateway (cpd, fw1) or Spark Firewall services correlated with VPN negotiation traffic
  on UDP/500 (IKE) or UDP/4500 (IPsec NAT-T), suggestive of ASN.1 heap buffer overflow
  exploitation.
tags:
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_cpd_restart:
    Image|endswith:
    - \cpd.exe
    - \fw1.exe
  selection_restart_pattern:
    CommandLine|contains:
    - restart
    - reboot
  filter_legitimate_maintenance:
    CommandLine|contains:
    - scheduled
    - maintenance
    - policy
    - update
  condition: selection_cpd_restart and selection_restart_pattern and not filter_legitimate_maintenance
falsepositives:
- Legitimate Check Point policy updates or gateway reboot cycles scheduled by administrators
- Automated failover or high-availability cluster state transitions
level: medium
id: 8a39767e-3e0e-5bf4-b25d-c67dec57bbd8
status: experimental
author: Vorant
```

### Anomalous VPN Certificate Processing via Certificate Validation Bypass

ATT&CK: T1553.002

Detects unusual certificate chain validation or trust store access patterns in Check Point VPN processes, indicative of CVE-2026-85102 improper certificate validation exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Anomalous VPN Certificate Processing via Certificate Validation Bypass
description: Detects access to certificate trust stores or validation bypass indicators
  within Check Point Security Gateway VPN negotiation processes (cpd, fw1), consistent
  with improper certificate validation flaw (CVE-2026-85102).
tags:
- attack.t1553.002
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_vpn_process:
    ParentImage|endswith:
    - \cpd.exe
    - \fw1.exe
  selection_cert_bypass_indicators:
    CommandLine|contains:
    - cert
    - certificate
    - validation
    - trust
    - verify
  selection_suspicious_child:
    Image|endswith:
    - \certutil.exe
    - \openssl.exe
  condition: (selection_vpn_process and selection_cert_bypass_indicators) or (selection_vpn_process
    and selection_suspicious_child)
falsepositives:
- Check Point certificate renewal or rotation scripts executed during maintenance
  windows
- Third-party PKI integration tools validating certificates during normal VPN operations
level: medium
id: dca2ac22-be2c-5bb3-b1b2-510fc0503631
status: experimental
author: Vorant
```

### Unauthenticated VPN Negotiation with Malformed ASN.1 Structures

ATT&CK: T1190

Detects network-level indicators of malformed or oversized ASN.1 certificate payloads in IKE/IPsec negotiation traffic targeting Check Point VPN gateways on UDP/500 or UDP/4500. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Unauthenticated VPN Negotiation with Malformed ASN.1 Structures
description: Detects inbound UDP traffic to Check Point Security Gateway on standard
  IKE (UDP/500) or IPsec NAT-T (UDP/4500) ports with anomalous payload patterns indicative
  of malformed ASN.1 certificate data exploitation.
tags:
- attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection_vpn_ports:
    DestinationPort:
    - 500
    - 4500
    Protocol: udp
  selection_large_payload:
    BytesIn|gt: 4096
  filter_known_vpn_peers:
    SourceIp:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection_vpn_ports and selection_large_payload and not filter_known_vpn_peers
falsepositives:
- Legitimate Site-to-Site VPN traffic from trusted branch office gateways with large
  policy payloads
- Remote Access VPN clients with high-entropy certificate data in normal negotiation
level: high
id: 1219ef6a-d2d7-5bc0-b935-56ed8c2c0247
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0365.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7a81f694-abb1-54ea-83dd-11e3e9152033/critical-unauthenticated-rce-flaws-in-check-point-vpn.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup