Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE

Summary

Check Point patched two critical VPN certificate flaws (CVE-2026-85102, CVE-2026-85103) with CVSS 9.8 scores. These allow unauthenticated remote code execution under specific, undisclosed conditions. Fixes are available via Live Patch or Jumbo Hotfix, though some customers report deployment issues and vague mitigation advice.

Key Takeaways

1. Check Point has patched two critical vulnerabilities in the way its firewall and management products handle VPN certificates.
2. The company says both could allow an unauthenticated remote attacker to run code, but only "under specific conditions" that it has not described.
3. Both records carry a CVSS score of 9.8.

Statement Breakdown

• Claimed Facts: 60% of statements the article presents as facts
• Opinions: 30% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents technical details about vulnerabilities and patches, citing specific CVE numbers and CVSS scores. It also references advisories from other cybersecurity organizations, lending it a degree of factual grounding. However, it relies heavily on statements from Check Point and customer reports, with limited independent verification.

Bias assessment: Security Vendor Focused. The article's primary focus is on disclosing and detailing security vulnerabilities within Check Point products. While it aims for objectivity, the narrative is framed around the actions and disclosures of a specific security vendor, potentially highlighting their security posture and response.

Note: This article details critical security vulnerabilities and patches. While technically informative, it primarily reflects the vendor's disclosures and customer experiences. Cross-reference with official vendor advisories for comprehensive details.

Credibility flag: Technical, Vendor-Centric

Claimed Facts (8)

• This is a direct statement of fact regarding the company's actions.
• This statement specifies which product line is affected by one of the vulnerabilities.
• This statement specifies which product lines are affected by the second vulnerability.
• This provides a timeline of disclosure and remediation efforts.
• This provides the specific CVE identifier and a technical description of the first vulnerability.
• This provides the specific CVE identifier and a technical description of the second vulnerability.
• This states the severity rating assigned to both vulnerabilities.
• This references an external advisory and its content.

Opinions (6)

• This is a statement of belief or assertion by the company, not a directly verifiable fact.
• The use of 'may be able to' indicates a potential rather than a confirmed outcome, leaning towards an informed opinion on exploitability.
• Similar to the above, 'may be able to' suggests a potential outcome based on the vulnerability's nature.
• This is a statement of belief or assertion by the company, not a directly verifiable fact.
• This is a claim about automatic protection, which is an assertion of the system's behavior.
• This is a statement from an employee about the applicability of a fix, which is an opinion on its compatibility.

Claims (6)

• The vagueness of "specific conditions" that are not described makes this claim difficult to assess and potentially misleading.
• This customer's subjective assessment of the mitigation being 'too vague' highlights a potential lack of clarity in the provided guidance.
• This is a reported experience from multiple customers that contradicts the company's claim of automatic protection, raising questions about the rollout's effectiveness.
• The discrepancy between customer reports of non-working links and the staff member's assertion that they were checked and working creates a point of contention and doubt.
• While the staff member's statement is technically correct, the lack of evidence of exploitation doesn't definitively mean none occurred, especially given the critical nature of the flaws.
• The lack of specific details in official notices makes it difficult for users to fully assess their risk and apply the correct fixes, raising questions about the completeness of the disclosure.

Key Sources

• Check Point — Security Vendor
• Canadian Center for Cyber Security — Government Cybersecurity Agency
• Customer — User of Check Point products