> Source: [sk1000117](https://support.checkpoint.com/results/sk/sk1000117) # sk1000117 - CVE-2026-85102 - Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN | Property | Value | |----------|-------| | Solution ID | sk1000117 | | Date Created | 2026-09-07 | | Last Modified | 2026-09-24 | | Technical Level | General | | Products | Security Gateway, Spark Firewall (Locally Managed), Spark Firewall (Centrally Managed) | | Versions | R82.10, R82, R81.20, R81.10 (EOS), R82.00.X, R81.10.X, R81 (EOS) | ## Symptoms - * **Issue:**Improper validation of certificate data during VPN negotiation may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway. * This issue received the ID [CVE-2026-85102](https://www.cve.org/CVERecord?id=CVE-2026-85102) with CVSS: 9.8. * For **Site-to-Site VPN** , the issue affects Security gateways that use or allow certificate-based authentication. Note: VPN with Dynamic IP Gateways (DAIP) or Large Scale VPN (LSV) Gateways in the community enables certificate authentication. Gateways that participate only in encryption communities where authentication is based on a Pre-Shared Key are not vulnerable. * **Update (September 20, 2026):** **This vulnerability is actively exploited on Spark Firewalls as of September 12, 2026.** * **Update (September 14, 2026): Important notification for customers who installed the Offline LivePatch Package and are running:** * R82.10 Jumbo Hotfix Take 24 or lower * R82 Jumbo Hotfix Take 107 or lower * R81.20 Jumbo Hotfix Take 146 or lower Following additional research, we identified a rare scenario in which customers must install **Check Point Live Patch Take 26** , which provides enhanced coverage for this CVE. * **Affected Products:**Security Gateway, Check Point Spark Firewall using Site to Site VPN or Remote Access VPN * **Affected Versions:** * R81.20, R82, R82.10 * R80, R80.10, R80.20, R80.30, R80.40, R81, R81.10 (all EoS) * R81.10.x, R82.00.x * **Not Affected Versions:** R82.20 ### How to identify this attack Review your logs for anomalous certificate-based Mobile Access logins. In **SmartConsole / Spark Management** , go to the **Logs \& Monitor** / **Logs \& Events** view and search for the query appearing after September 12, 2026: *product: "Mobile Access"* *AND action:* *"Log In" AND "Certificate"* Any events should be inspected for unrecognized users, clients, or source IP addresses. If confirmed as unauthorized, look for second-stage activity originating from suspicious users, such as scans of internal ports and services. In addition, see below the suspicious subjects we have observed so far. The list is not exhaustive, and other certificate subjects may be in use: CN=vpn,OU=users,O=global CN=vpn-user,OU=users,O=global CN=vpnuser,OU=users,O=global ### Mitigation Use this mitigation only if the affected system cannot be updated through Jumbo Hotfix Accumulator or Check Point LivePatch. Exercise caution when disabling VPN implied rules and configuring explicit rules, as an incorrect configuration can cause connectivity issues. **For Site to Site VPN** , disable implied rules for VPN and manually define VPN access for UDP/500 and UDP/4500 for the specific peer IP addresses. Refer to [sk179346](https://support.checkpoint.com/results/sk/sk179346). **For Remote Access VPN**: Disable the Remote Access VPN implied rules. Create explicit Access Control rules that allow the required Remote Access VPN services to the Security Gateway: * UDP/500 (IKE), UDP/4500 (NAT-T), TCP/443 (SSL), TCP/80 (when applicable) * Specify the source of the Remote Access clients' IP address ranges if applicable. **Note:** These mitigation options are not applicable to the locally managed Spark Firewall. ## Solution This problem was fixed. ### Option 1: The fix is included in [Check Point LivePatch](https://support.checkpoint.com/results/sk/sk185114) **Automatic installation** If you have enabled automatic installation of Check Point LivePatch, **the protection will be applied automatically**. **Manual installation** Download the offline package from the table below: |------------|-------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------| | Version | Take Number | Download Package | | **R82.10** | BUNDLE_URGENT_SECURITY_UPDATE_R82_10_AUTOUPDATE **take 26** | [![](https://sc1.checkpoint.com/sc/images/download-m.png)](https://support.checkpoint.com/results/download/145465) (TAR) | | **R82** | BUNDLE_URGENT_SECURITY_UPDATE_R82_AUTOUPDATE **take 26** | [![](https://sc1.checkpoint.com/sc/images/download-m.png)](https://support.checkpoint.com/results/download/145466) (TAR) | | **R81.20** | BUNDLE_URGENT_SECURITY_UPDATE_R81_20_AUTOUPDATE **take 26** | [![](https://sc1.checkpoint.com/sc/images/download-m.png)](https://support.checkpoint.com/results/download/145467) (TAR) | For instructions on the offline package installation procedure, refer to [sk185114](https://support.checkpoint.com/results/sk/sk185114). To validate that LivePatch is properly installed and active, run the cpinfo -y CPupdates command on the Security Gateway / ClusterXL member in Expert mode and validate that you have BUNDLE_URGENT_SECURITY_UPDATE_R82_AUTOUPDATE Take 26 Example: ``` [Expert@Host:0]# cpinfo -y CPupdates [CPUpdates] ??BUNDLE_URGENT_SECURITY_UPDATE_R82_AUTOUPDATE??Take:� 26 ``` For LivePatch validation, run in Expert mode: * On a Security Gateway / ClusterXL member:cplp list * On a Scalable Platform Security Group: g_all cplp list Expected output: ``` cpcert:cpca*����������CVE-2026-85102 CVE-2026-85103 cpcert:iked*��������� CVE-2026-85102 CVE-2026-85103 cpcert:vpn*���������� CVE-2026-85102 CVE-2026-85103 cpcert:vpnrad*������ CVE-2026-85102 CVE-2026-85103 cpcert_cprid:cprid*�� CVE-2026-85102 CVE-2026-85103 ``` ### Option 2: The fix is also included in: * **[Jumbo Hotfix Accumulator for R82.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) starting from Take 44** * **[Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 126** * **[Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 166** * **[Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 190** * **[Check Point Spark Firewalls R82.00.10](https://support.checkpoint.com/results/sk/sk184357) starting from Build 2325** * **[Check Point Spark Firewalls R81.10.17](https://support.checkpoint.com/results/sk/sk183153) starting from Build 4968** --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content