CVE-2026-85103 - ASN.1 decoding heap overflow leading to a remote code execution

• • Issue: A heap overflow in the VPN certificate ASN.1 decoding flow may allow a remote attacker to remotely execute arbitrary code on the management and Security Gateway.
  • This issue received the ID CVE-2026-85103 with CVSS: 9.8.
  • Affected Products: Security Management Server, Security Gateway, Check Point Spark Firewall
  • Affected Versions: 
    • R81.20, R82, R82.10
    • R80, R80.10, R80.20, R80.30, R80.40, R81, R81.10 (all EoS)
    • R81.10.x, R82.00.x
  • Not Affected Versions: R82.20

  
  

  Mitigation

  For Site to Site VPN, disable implied rules for VPN and manually define VPN access for UDP/500 and UDP/4500 for the specific peer IP addresses.

  Note: This mitigation option is not applicable to the locally managed Spark Firewall.

This problem was fixed. 

Option 1: If you have enabled automatic installation of Check Point LivePatch, you are already protected. 

Version	Take Number	Download Package
R82.10	BUNDLE_URGENT_SECURITY_UPDATE_R82_10_AUTOUPDATE take 24	(TAR)
R82	BUNDLE_URGENT_SECURITY_UPDATE_R82_AUTOUPDATE take 24	(TAR)
R81.20	BUNDLE_URGENT_SECURITY_UPDATE_R81_20_AUTOUPDATE take 24	(TAR)

To validate that LivePatch is properly installed and active, run the cpinfo -y CPupdates command on the Security Gateway / ClusterXL member in Expert mode and validate that you have BUNDLE_URGENT_SECURITY_UPDATE_R82_AUTOUPDATE Take 24 

Example:

[Expert@Host:0]# cpinfo -y CPupdates
[CPUpdates]
  BUNDLE_URGENT_SECURITY_UPDATE_R82_AUTOUPDATE  Take:  24

For LivePatch validation, run in Expert mode: 

• On a Security Gateway / ClusterXL member: cplp list
• On a Scalable Platform Security Group: g_all cplp list

Expected output:

cpcert:cpca*          CVE-2026-85102 CVE-2026-85103
cpcert:iked*          CVE-2026-85102 CVE-2026-85103
cpcert:vpn*           CVE-2026-85102 CVE-2026-85103
cpcert:vpnrad*        CVE-2026-85102 CVE-2026-85103
cpcert_cprid:cprid*   CVE-2026-85102 CVE-2026-85103

Option 2: The fix is also included in:

• Jumbo Hotfix Accumulator for R82.10 starting from Take 44
• Jumbo Hotfix Accumulator for R82 starting from Take 126
• Jumbo Hotfix Accumulator for R81.20 starting from Take 166
• Check Point Spark Firewalls R82.00.10 starting from Build 2325
• Check Point Spark Firewalls R81.10.17 starting from Build 4968