Posted on

Check Point VPN CVE-2026-85102 and CVE-2026-85103 – Critical Pre-Authentication Remote Code Execution

Threat Overview

Check Point disclosed two critical VPN-related vulnerabilities on September 9, 2026: CVE-2026-85102 and CVE-2026-85103. Check Point states both were found internally and that it has no indication of active exploitation. CVE-2026-85102 concerns certificate trust validation during VPN negotiation and can under specific conditions permit unauthenticated remote code execution on affected Quantum Security Gateways. CVE-2026-85103 is a heap-based buffer overflow in ASN.1 decoding of VPN certificates that can also permit unauthenticated remote code execution. Check Point has not published exploit payloads, malicious certificate fingerprints, attacker IPs, or a reliable request signature, so these hunts use behavioral pivots rather than fabricated CVE signatures.

References

Impacted Systems

Vendor/product: Check Point Quantum Security Gateway; CVE-2026-85103 also includes Quantum Security Management components in public vendor-indexed data. VPN surfaces: Remote Access VPN and Site-to-Site VPN negotiation/certificate processing. Authentication: none. Publicly indexed affected-version information includes R81.20 through Jumbo Hotfix Take 165, R82 through Take 125, and R82.10 through Take 43 for affected gateway branches. Validate the complete applicability matrix and exact fixed take directly in sk1000117/sk1000118. Check Point states Live Patch rollout began September 9, 2026 and recommends the latest applicable Jumbo Hotfix. Exposure is highest on gateways accepting VPN negotiation from untrusted networks, commonly UDP/500, UDP/4500, and TCP/443 where applicable.

Why this matters

These flaws sit in pre-authentication VPN processing on enterprise security gateways. Successful exploitation could provide code execution on a network-perimeter device, so patching and exposure validation are high priority even though exploitation has not been observed.

Exploitation Status

No confirmed active exploitation as of the September 9, 2026 Check Point disclosure. Check Point states the vulnerabilities were discovered internally and it has no indication of exploitation. Claims of exploit IPs, malicious certificates, or known payloads should be treated as unverified unless authoritative evidence emerges.

What this hunt looks for

New and high-volume sources reaching known Check Point VPN gateway services, unusual VPN/certificate decoding or negotiation errors, raw gateway crash/error messages, failure-to-success patterns, and rare outbound traffic from known gateway IPs.

Required logs

  • Check Point CEF/CommonSecurityLog covering gateway/VPN traffic
  • Check Point gateway Syslog for raw VPN, certificate, decoder, and crash/error messages
  • Upstream network telemetry when gateway logs do not expose the pre-authentication path

First Pass – New Sources Reaching Check Point VPN Services

let GatewayIPs = dynamic(["REPLACE_WITH_CHECK_POINT_GATEWAY_IP"]);
let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(2d))
| where DestinationIP in (GatewayIPs)
| where DestinationPort in (443,500,4500)
| summarize by SourceIP, DestinationIP, DestinationPort;
CommonSecurityLog
| where TimeGenerated > ago(2d)
| where DestinationIP in (GatewayIPs)
| where DestinationPort in (443,500,4500)
| join kind=leftanti Baseline on SourceIP, DestinationIP, DestinationPort
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP, DestinationPort
| order by FirstSeen desc

High-Volume VPN Negotiation Attempts

let GatewayIPs = dynamic(["REPLACE_WITH_CHECK_POINT_GATEWAY_IP"]);
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationIP in (GatewayIPs)
| where DestinationPort in (443,500,4500)
| summarize Connections=count(), Actions=make_set(DeviceAction,20), Ports=make_set(DestinationPort,10) by SourceIP, DestinationIP, bin(TimeGenerated,5m)
| where Connections >= 30
| order by TimeGenerated desc

VPN Certificate or Negotiation Errors in Check Point Logs

CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceVendor has "Check Point"
| where Activity has_any ("VPN","IKE","IPsec") or Message has_any ("VPN","IKE","IPsec")
| where Message has_any ("certificate","ASN.1","decode","invalid","failed","failure","error")
| project TimeGenerated, DeviceName, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity, Message
| order by TimeGenerated desc

Raw Check Point Syslog Certificate or VPN Decoder Anomalies

Syslog
| where TimeGenerated > ago(14d)
| where SyslogMessage has_any ("VPN","IKE","IPsec")
| where SyslogMessage has_any ("certificate","ASN.1","decode","invalid","failed","failure","error","crash","core")
| project TimeGenerated, Computer, ProcessName, Facility, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

Rare Outbound Destinations From Check Point Gateways

let GatewayIPs = dynamic(["REPLACE_WITH_CHECK_POINT_GATEWAY_IP"]);
let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(2d))
| where SourceIP in (GatewayIPs)
| summarize by DestinationIP, DestinationPort;
CommonSecurityLog
| where TimeGenerated > ago(2d)
| where SourceIP in (GatewayIPs)
| join kind=leftanti Baseline on DestinationIP, DestinationPort
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP, DestinationPort
| order by FirstSeen desc

VPN Source Touching Multiple Gateway Services

let GatewayIPs = dynamic(["REPLACE_WITH_CHECK_POINT_GATEWAY_IP"]);
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationIP in (GatewayIPs)
| where DestinationPort in (443,500,4500)
| summarize Connections=count(), Ports=make_set(DestinationPort,10), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP, bin(TimeGenerated,15m)
| where array_length(Ports) >= 2
| order by Connections desc

Check Point VPN Failure Burst Followed by Accepted Activity

let GatewayIPs = dynamic(["REPLACE_WITH_CHECK_POINT_GATEWAY_IP"]);
let Failures = CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationIP in (GatewayIPs)
| where DestinationPort in (443,500,4500)
| where DeviceAction has_any ("deny","drop","reject","fail") or Message has_any ("failed","failure","invalid","error")
| summarize FailCount=count(), FirstFail=min(TimeGenerated), LastFail=max(TimeGenerated) by SourceIP, DestinationIP, bin(TimeGenerated,15m)
| where FailCount >= 10;
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationIP in (GatewayIPs)
| where DestinationPort in (443,500,4500)
| where DeviceAction has_any ("accept","allow","success")
| project AcceptTime=TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity, Message
| join kind=inner Failures on SourceIP, DestinationIP
| where AcceptTime between (LastFail .. LastFail + 30m)
| project AcceptTime, SourceIP, DestinationIP, DestinationPort, DeviceAction, FailCount, FirstFail, LastFail, Activity, Message
| order by AcceptTime desc

Detection Notes

There is no public exploit signature, so the first-pass query is an exposure/anomaly hunt rather than proof of exploitation. UDP/500, UDP/4500, and TCP/443 are common VPN service ports but deployments vary. Certificate, ASN.1, IKE, and VPN error searches depend on message normalization and may require field changes for a specific Check Point connector. Legitimate roaming users and VPN scanners can generate noise. A crash may not occur during successful exploitation. Without Check Point gateway logs or upstream network telemetry, Sentinel cannot reliably see the pre-auth attack path.

Leave a comment