topic Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026- in General Topics

[Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-8510

_Val_ — Wed, 09 Sep 2026 13:04:32 GMT

Hey CheckMates

Check Point research team has identified and remediated two critical VPN-related vulnerabilities, CVE-2026-85102 and CVE-2026-85103, which could potentially allow unauthenticated remote code execution under specific conditions. These issues were discovered internally, and we have no indication of active exploitation.

To ensure continued protection, we strongly recommend installing the latest Jumbo Hotfix for your deployed version as soon as it becomes available.

Please note that customers using Check Point Live Patch will be automatically protected as the rollout begins on September 9, 2026. If you are not using Check Point Live Patch, read sk185114 for more details on how you can benefit and stay protected.

For detailed information, affected products, mitigation guidance, and remediation instructions, please refer to the following Security Advisories:

CVE-2026-85102: Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN - sk1000117

CVE-2026-85103: ASN.1 Decoding Heap Overflow Leading to Remote Code Execution - sk1000118

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

Pavol-T — Wed, 09 Sep 2026 13:25:10 GMT

Regarding CVE-2026-85103, to me it's not clear if gateways with VPN software blade disabled are affected too. Any ideas or further information? Thank you

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

J_admin12 — Wed, 09 Sep 2026 15:32:26 GMT

Thanks,

At what time will the Spark SK articles be updated to show the new builds? Currently neither are showing the latest patched versions.

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

StackCap43382 — Wed, 09 Sep 2026 13:32:34 GMT

When is the CPLP package going to be pushed?

All the devices I've checked still have V18.

Will this package require any manual intervention for CPLP to apply the code fix to the processes?

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

henfii — Wed, 09 Sep 2026 13:36:11 GMT

Hello, where can I find the exact firmware for Spark? There are still unupdated FWs build on the site.

Check Point Spark Firewalls R82.00.10 starting from Build 2325
Check Point Spark Firewalls R81.10.17 starting from Build 4968

Thank you

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

ccsjnw — Wed, 09 Sep 2026 13:54:10 GMT

None of the download links work:

https://support.checkpoint.com/results/sk/sk1000117/
https://support.checkpoint.com/results/sk/sk1000118/

https://support.checkpoint.com/results/download/145356

Also, if I click Check for Updates in the Gaia WebUI, it shows Jumbo Take 122 for R82 as being the latest available and Jumbo Take 40 as the latest available for R82.10.

I received the email notification from CheckPoint 48 minutes ago.

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

StackCap43382 — Wed, 09 Sep 2026 13:52:02 GMT

Also why is the Jumbo for these CVEs integrated with dozens of other fixes? This should be a targeted JHF so people can install without a repeat of the recent DHCP bug.

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

PhoneBoy — Wed, 09 Sep 2026 13:57:01 GMT

I assume this is done on a rollout basis and not done to everyone all at ones.
If you need to apply immediately, you can download the relevant update (Take 24) from: https://support.checkpoint.com/results/sk/sk185114

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

CaseyB — Wed, 09 Sep 2026 14:04:16 GMT

The Live Patch download links work here.

I have already applied Urgent Take 24 and it works well. Better than the jumbo approach for sure.

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

StackCap43382 — Wed, 09 Sep 2026 14:05:35 GMT

Done that in a lab.

Waiting to see if it actually armes the ready processes or not.

[Expert@FWA-01:0]# cplp list
ID(PATCH:PROC) STATUS MODE PIDS INSTALLED COMMENT
--------------------------------------------------------------------------
vpn1:iked ready livepatch 0/0 2026-07-15 08:13:55 sk185033
vpn1:vpnd ready livepatch 0/0 2026-07-15 08:13:55 sk185033

One row per <name>:<proc> deployment (revert/status target). Use `cplp status --patch-id <name>` for live per-pid state.
[Expert@FWA-01:0]# autoupdatercli install /home/admin/urgent_security_updates_R81_20_Bundle_T24_AutoUpdate.tar

Install request of component urgent_security_updates version 24 handled. To see installation status, see logs: /opt/CPInstLog/AutoUpdater.log and /opt/CPInstLog/AutoUpdateLogs/urgent_security_updates

[Expert@FWA-01:0]# cplp list
ID(PATCH:PROC) STATUS MODE PIDS INSTALLED COMMENT
--------------------------------------------------------------------------
cpcert:cpca* ready livepatch 0/0 2026-09-09 15:01:30 CVE-2026-85102 CVE-2026-85103
cpcert:ike* armed livepatch 1/1 2026-09-09 15:01:30 CVE-2026-85102 CVE-2026-85103
cpcert:vpn* armed livepatch 1/1 2026-09-09 15:01:30 CVE-2026-85102 CVE-2026-85103
cpcert:vpnrad* ready livepatch 0/0 2026-09-09 15:01:30 CVE-2026-85102 CVE-2026-85103
cpcert:wstlsd* armed livepatch 2/2 2026-09-09 15:01:30 CVE-2026-85102 CVE-2026-85103
cpcert_cprid:cprid* armed livepatch 1/1 2026-09-09 15:01:29 CVE-2026-85102 CVE-2026-85103
vpn1:iked* jumbofix livepatch 0/0 2026-07-15 09:13:55 sk185033
vpn1:vpnd* jumbofix livepatch 0/0 2026-07-15 09:13:55 sk185033

* reports to the management audit trail (`cplp coverage disable --patch-id <name>` to stop).
[Expert@FWA-01:0]#

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

CaseyB — Wed, 09 Sep 2026 14:06:02 GMT

You can manually apply the CPLP to stay on your current JHF or wait for Check Point to push it to your gateways IF you have it enabled.

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

Magnus-Holmberg — Wed, 09 Sep 2026 14:06:44 GMT

Question.

We see that we have.

[CPUpdates]
BUNDLE_URGENT_SECURITY_UPDATE_R81_20_AUTOUPDATE Take: 18

But none of our boxes we are able to run

[Expert@se-sec-fw001_n1:0]# cplp list
bash: cplp: command not found

Regards,
Magnus

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

ccsjnw — Wed, 09 Sep 2026 14:07:10 GMT

CaseyB, that page is blank when I open (and fresh it) from the UK...

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

CaseyB — Wed, 09 Sep 2026 14:09:59 GMT

Strange. Here are the direct links (R81.20, R82, R82.10 probably not in order):

https://support.checkpoint.com/results/download/145415

https://support.checkpoint.com/results/download/145416

https://support.checkpoint.com/results/download/145417

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

ccsjnw — Wed, 09 Sep 2026 14:14:55 GMT

Still not working here:

See the above screenshot...
Are you positive that these links have been made available to customers, and not just internally?

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

Fr4nkys — Wed, 09 Sep 2026 14:15:15 GMT

hello magnus you can find it inside here:

Just run the command like this copy and paste : /usr/local/bin/cplp list

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

Magnus-Holmberg — Wed, 09 Sep 2026 14:18:33 GMT

Ye that works 🙂

[Expert@se-sec-vsx030_n1:0]# /usr/local/bin/cplp list
ID(PATCH:PROC) STATUS MODE PIDS INSTALLED COMMENT
--------------------------------------------------------------------------
vpn1:iked ready livepatch 0/0 2026-09-02 11:57:45
vpn1:vpnd ready livepatch 0/0 2026-09-02 11:57:45

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

CaseyB — Wed, 09 Sep 2026 14:19:42 GMT

That's what I used as a customer. ¯\_(ツ)_/¯

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

Fernando — Wed, 09 Sep 2026 14:24:37 GMT

And Mobile Access ??

Re: [Action Required] - Critical Security Advisory: VPN Vulnerabilities CVE-2026-85102 and CVE-2026-

Alex- — Wed, 09 Sep 2026 14:30:51 GMT

Since the vulnerability was found internally, are there any indicators in logs which would allow to identify attempts?