CVE-2026-85102: Improper Certificate Validation in Check Point Security Gateway & Spark Firewall Enables Remote Code Execution
What It Is — Check Point Security Gateway and Spark Firewall VPN components fail to properly validate X.509 certificates. An unauthenticated remote attacker can exploit the flaw to execute arbitrary code on the appliance.
Exploitability — No public exploit has been observed, but the vulnerability is rated CVSS 3.1 8.8 (High) and is exploitable over the network without credentials.
Affected Products — Check Point Security Gateway (all current firmware releases) and Check Point Spark Firewall when used for Site‑to‑Site or Remote‑Access VPN.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for secure configuration and cryptographic validation controls that can be continuously monitored and evidenced for audit purposes.
- A missing or weak certificate‑validation control creates a gap that attackers can leverage to bypass network perimeter defenses, eroding the trust posture that customers demand.
- Continuous evidence of patch management and configuration compliance is a core signal for third‑party risk assessments and regulatory reviews.
Recommended Actions
- Apply the Check Point advisory patch immediately; verify the patch level on all VPN appliances.
- Conduct a configuration audit to confirm that certificate validation is enforced for all VPN tunnels.
- Enable logging of TLS handshake failures and integrate those logs into a centralized SIEM for real‑time monitoring.
- Map the remediation to your control‑mapping framework and capture evidence for audit readiness.
Source: CISA KEV – CVE‑2026‑85102