BlueMoon: The Exploit Kit Powering Multiple Spy Groups and Zero-Day Attacks
Two Critical Check Point Flaws Expose VPN Gateways to Unauthenticated Remote Code Execution
CVE-2026-85102 and CVE-2026-85103 affect VPN-enabled Check Point gateways and management systems. Both carry a CVSS score of 9.8 and should be treated as urgent perimeter-security risks.
Summary
Check Point has released emergency fixes for two critical vulnerabilities that can allow an unauthenticated remote attacker to execute arbitrary code on exposed security appliances. CVE-2026-85102 arises from improper validation of certificate data during VPN negotiation. CVE-2026-85103 is a heap-based buffer overflow in the ASN.1 decoding of VPN certificates.
Both vulnerabilities are network-reachable, require no privileges or user interaction, and carry a CVSS v3.1 score of 9.8. Organizations should identify affected Security Gateways, Quantum Security Management systems, and Spark Firewalls; install the applicable LivePatch or Jumbo Hotfix; verify that the protection is active; and review exposed systems for suspicious VPN and certificate-processing activity.
Background
Security Gateways terminate VPN traffic and enforce access controls at the network perimeter, while Security Management Servers hold security policies, gateway configuration, certificates, and administrative data. Code execution on either tier can expose sensitive configuration, disrupt security controls, or provide a path into protected networks.
CVE-2026-85102 and CVE-2026-85103 are separate vulnerabilities even though Check Point addresses them through overlapping LivePatch and Jumbo Hotfix releases. The first affects certificate validation during VPN negotiation. The second affects ASN.1 certificate decoding and can corrupt process memory. At publication time, the reviewed vendor notices provide fixes but do not publish exploit-specific indicators of compromise or confirm broad in-the-wild exploitation of both vulnerabilities.
Vulnerability Details
| CVE ID | CVSS Score | Weakness | Affected Products | Impact |
|---|---|---|---|---|
| CVE-2026-85102 | 9.8 Critical | Improper certificate-data validation during VPN negotiation | Security Gateway and centrally or locally managed Spark Firewall deployments using Remote Access VPN or Site-to-Site VPN | Unauthenticated remote code execution |
| CVE-2026-85103 | 9.8 Critical | CWE-122 heap-based buffer overflow in VPN certificate ASN.1 decoding | Quantum Security Gateway and Quantum Security Management | Unauthenticated remote code execution |
How CVE-2026-85102 Works
CVE-2026-85102 affects certificate-data validation in the VPN negotiation path. A remote attacker who can reach a vulnerable VPN service may submit malformed certificate information that is not validated safely. The flaw can be triggered without valid credentials and can lead to arbitrary code execution on the Security Gateway.
Check Point identifies Security Gateway and centrally or locally managed Spark Firewall deployments using Site-to-Site VPN or Remote Access VPN as affected. Relevant releases include R81.20, R82, R82.10, R81.10.x, and R82.00.x, along with end-of-support R80 through R81.10 releases. R82.20 is listed as not affected.
How CVE-2026-85103 Works
CVE-2026-85103 occurs while the product decodes ASN.1-encoded VPN certificate data. A specially crafted certificate can trigger a heap-based buffer overflow, corrupt process memory, and allow attacker-controlled code to execute.
The affected scope includes Quantum Security Gateway and Quantum Security Management. For supported branches, deployments at or below R81.20 Jumbo Hotfix Take 165, R82 Jumbo Hotfix Take 125, and R82.10 Jumbo Hotfix Take 43 require remediation. End-of-support releases should be migrated to supported, fixed releases.
Attack Methodology
- Discovery: An attacker identifies an exposed Check Point VPN endpoint or reachable management service.
- Delivery: The attacker submits maliciously formed VPN certificate data during negotiation.
- Exploitation: Certificate processing triggers improper validation or heap corruption before authentication.
- Execution: Attacker-controlled code runs in the context of the affected gateway or management appliance.
- Post-exploitation: The attacker may access configuration, disrupt security controls, establish persistence, or pivot toward internal systems.
This sequence describes the plausible technical path created by the vulnerabilities. It does not assert that Check Point has observed every phase in an active campaign.
Detection and Investigation
No public exploit-specific indicators of compromise were included in the vendor notices reviewed for this article. Detection should focus on abnormal VPN negotiation, certificate parsing, process behavior, configuration changes, and post-exploitation activity around affected appliances.
VPN and Certificate Processing
- Repeated or malformed VPN negotiation attempts from unfamiliar sources
- Unusual certificate-decoding failures or crashes in VPN-related services
- Unexpected service restarts following inbound UDP 500 or UDP 4500 traffic
- A sudden increase in failed negotiations that does not match normal user activity
Appliance and Management Activity
- Unexpected administrative sessions or configuration changes
- New accounts, certificates, trust objects, VPN peers, or policy modifications
- Unrecognized outbound connections from a gateway or management server
- Unexplained files, processes, scheduled activity, or persistence mechanisms
- Gaps, deletions, or anomalies in security and audit logs
If exploitation is suspected, preserve relevant logs and forensic data before restarting or rebuilding the appliance. Installing a patch closes the vulnerability but does not remove persistence established before remediation.
Mitigation
Check Point provides LivePatch bundles for R81.20, R82, and R82.10. The fixes are also included in the Jumbo Hotfix and Spark Firewall builds listed below. Administrators should consult the applicable vendor advisory because supported packages vary by product and release.
| Release | Minimum Fixed Level |
|---|---|
| R81.20 | Jumbo Hotfix Accumulator Take 166 or applicable LivePatch |
| R82 | Jumbo Hotfix Accumulator Take 126 or applicable LivePatch |
| R82.10 | Jumbo Hotfix Accumulator Take 44 or applicable LivePatch |
| Spark R82.00.10 | Build 2325 or later |
| Spark R81.10.17 | Build 4968 or later |
Temporary Mitigation for CVE-2026-85102
For Site-to-Site VPN, Check Point recommends disabling implied VPN rules and manually allowing UDP 500 and UDP 4500 only from the IP addresses of authorized VPN peers. This mitigation reduces exposure to untrusted sources but is not applicable to locally managed Spark Firewall deployments. It should not replace the vendor fix.
Validate LivePatch Installation
After installation, verify that the protection is active. On a Security Gateway or ClusterXL member, run:
cplp listOn a Scalable Platform Security Group, run:
g_all cplp listThe output should identify CVE-2026-85102 and CVE-2026-85103 for the relevant protected processes. Administrators can also run cpinfo -y CPupdates in Expert mode to confirm the installed bundle and take number.
