CVE-2026-85102 — Check Point Unauthenticated VPN Tunnel Establishment

Exploits CVE-2026-85102 to establish an unauthenticated VPN tunnel on Check Point Security Gateway by bypassing IKE certificate chain validation.

Official Check Point Advisory: sk1000117

Vulnerability

CVE-2026-85102 — VPN Certificate Chain Validation Bypass

Product: Check Point Security Gateway, Check Point Spark Firewall Affected Versions: R81.20, R82, R82.10 (pre-Bundle T24), R80-R81.10 (all EoS) Not Affected: R82.20
Component: libcpcert.so — fwKeyHolder_imp::IsChainTrusted()
Root Cause: IsChainTrusted() calls CanonizeChain() but ignores its return value. Even when chain canonicalization fails, the function returns TRUSTED.

Exploitation: An attacker can:

1. Extract the ICA intermediate certificate from the target (port 18190 or 443)
2. Forge a leaf certificate using the ICA's Issuer DN
3. Corrupt the ICA certificate signature to trigger CanonizeChain() failure
4. The forged certificate chain is still accepted as trusted
5. Complete IKE authentication without valid credentials

Repository Structure

CVE-2026-85102.py   # CVE-2026-85102: VPN tunnel establishment (auth bypass)
cp_postex.py             # Post-exploitation helper (tunnel management, recon)

Prerequisites

Attack Machine Requirements

• OS: Linux (Ubuntu/Debian/Kali recommended)
• Privileges: root or sudo (for kernel IPsec SA configuration)
• Python: 3.8 or later
• Dependencies: pip install cryptography
• Tools: openssl, iproute2 (ip command), nc (netcat)

Target Requirements

• Check Point Security Gateway R81.20, R82, or R82.10
• Pre-Bundle T24
• VPN blade enabled with Remote Access community configured
• At least one VPN username known (e.g., testuser)
• Ports UDP/500 and TCP/443 accessible from attacker

Usage

Establish VPN Tunnel

# Establish tunnel with certificate bypass
sudo python3 CVE-2026-85102.py<target_ip> -u <vpn_username>
# Output includes Office Mode IP, e.g., 172.16.10.3

# Clean up tunnel
sudo python3 CVE-2026-85102.py--cleanup

Post-Exploitation Helper

# Establish tunnel and save state
sudo python3 cp_postex.py tunnel up <target_ip> -u <vpn_username>

# Check tunnel status
sudo python3 cp_postex.py tunnel status

# Scan gateway ports through tunnel
sudo python3 cp_postex.py recon scan
sudo python3 cp_postex.py recon scan -p 80,443,18190-18208

# Sweep internal networks through tunnel
sudo python3 cp_postex.py recon sweep 192.168.1.0/24
sudo python3 cp_postex.py recon sweep 192.168.1.0/24 -p 22

# Tear down tunnel
sudo python3 cp_postex.py tunnel down
sudo python3 cp_postex.py tunnel down -f  # Flush all xfrm state

Parameters

Parameter	Description
<target_ip>	Check Point gateway IP
-u <username>	VPN username (default: testuser)
-l <local_ip>	Manual local IP for multi-interface systems
-c <cert_host>	Alternative host for ICA certificate extraction
--cleanup	Remove tunnel configuration

Impact

• Attack Vector: Network (internet-reachable)
• Attack Complexity: Low (fully automated)
• Required Privileges: None
• User Interaction: None
• Confidentiality Impact: High (access to protected network)
• Integrity Impact: Medium (can modify traffic through tunnel)
• Availability Impact: Low
• CVSS 3.1: 9.8 (Critical)

Detection

Review logs for anomalous certificate-based Mobile Access logins. In SmartConsole/Spark Management, go to Logs & Monitor / Logs & Events and search for events after September 12, 2026:

product: "Mobile Access" AND action: "Log In" AND "Certificate"

Inspect events for unrecognized users, clients, or source IP addresses.

Suspicious certificate subjects observed:

• CN=vpn,OU=users,O=global
• CN=vpn-user,OU=users,O=global
• CN=vpnuser,OU=users,O=global

Remediation

Fix Options for CVE-2026-85102

Option 1: Check Point LivePatch (Recommended)

Install LivePatch Take 26 (BUNDLE_URGENT_SECURITY_UPDATE):

• R82.10: Take 26
• R82: Take 26
• R81.20: Take 26

Validate installation:

# Check LivePatch status
cplp list

# Expected output includes:
# cpcert:cpca*    CVE-2026-85102 CVE-2026-85103
# cpcert:iked*    CVE-2026-85102 CVE-2026-85103
# cpcert:vpn*     CVE-2026-85102 CVE-2026-85103
# cpcert:vpnrad*  CVE-2026-85102 CVE-2026-85103
# cpcert_cprid:cprid* CVE-2026-85102 CVE-2026-85103

Option 2: Jumbo Hotfix Accumulator

• R82.10: Take 44 or later
• R82: Take 126 or later
• R81.20: Take 166 or later
• R81.10: Take 190 or later

Spark Firewalls

• Spark R82.00.10: Build 2325 or later
• Spark R81.10.17: Build 4968 or later

Patch Details (CVE-2026-85102)

The fix modifies libcpcert.so:

// IsChainTrusted: Check CanonizeChain return value
result = CanonizeChain(this, trusted_ca, sorted, out, i, trust_type);
if (!result) {
    trusted_ca = NULL;
}
return trusted_ca;

// CanonizeChain: Check intermediate operation returns
if (!CopyChain(...)) return NULL;
if (!TruncateChain(...)) return NULL;

Mitigations (If Cannot Patch)

For Site-to-Site VPN

Disable implied VPN rules and manually define VPN access for UDP/500 and UDP/4500 for specific peer IP addresses. See sk179346.

For Remote Access VPN

Disable Remote Access VPN implied rules. Create explicit Access Control rules allowing required Remote Access VPN services to the Security Gateway:

• UDP/500 (IKE), UDP/4500 (NAT-T), TCP/443 (SSL), TCP/80 (when applicable)
• Specify source IP address ranges for Remote Access clients if applicable

Note: These mitigations are not applicable to locally managed Spark Firewalls.

General Recommendations

• Restrict VPN service exposure to trusted networks
• Monitor VPN session logs for anomalous logins
• Implement network segmentation between VPN clients and management interfaces

References

• Check Point Advisory: sk1000117
• CVE-2026-85102: NVD
• RFC 5996: IKEv2 Protocol Specification

License

This exploit code is provided for security research and testing purposes. Use on your own systems or with explicit authorization from the system owner.