If your organization uses Check Point firewalls or VPN gateways to let employees connect remotely or to link offices together, this is worth reading now rather than later. Check Point has disclosed and patched two critical security flaws in how its products handle VPN certificates. Both flaws are rated 9.8 out of 10 in severity, both could let an attacker take over a device without needing a username or password, and a national cybersecurity agency is now warning that real-world attacks should be expected soon.
Check Point found the problems itself and says it has no evidence anyone has exploited them yet. That is good news, but it is also exactly the situation in which organizations tend to move too slowly: no headline-grabbing breach has happened, so patching gets pushed down the priority list. The Dutch National Cyber Security Centre (NCSC) has explicitly warned against that instinct here, rating both the likelihood and the impact of exploitation as high.
What happened
On September 9, 2026, Check Point notified customers of two vulnerabilities affecting its Security Gateway, Security Management Server, and Spark Firewall product lines, all of which are used to run VPN connections for remote workers and site-to-site links between offices. The company published two advisories, sk1000117 and sk1000118, and began rolling out fixes the same day.
Check Point says its own research team discovered both issues, and that it has seen no indication of active exploitation or a public proof-of-concept exploit. That assessment held as of the company's own disclosure and as of the Dutch NCSC's advisory on September 12, which likewise notes that no public exploit has surfaced so far.
The NCSC's warning is the part that should get attention from anyone weighing how urgently to patch. The agency wrote that it assesses the likelihood of exploitation and the potential impact as high, and that it expects exploitation attempts to occur soon, urging organizations to install the updates as soon as possible.
What are CVE-2026-85102 and CVE-2026-85103?
Both vulnerabilities live in the way Check Point products process VPN certificates, but they are distinct bugs with distinct root causes.
CVE-2026-85102: certificate trust validation failure
Per Check Point's advisory, CVE-2026-85102 is an improper validation of certificate data during VPN negotiation, the process a Check Point Security Gateway or Spark Firewall runs through when a VPN connection is being established, and it may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway. An attacker does not need a valid login or any prior access; a malformed or untrusted certificate presented during negotiation is enough to push the process into a state where code execution becomes possible.
Check Point scopes this one specifically to Security Gateway and Spark Firewall deployments that are using Site-to-Site VPN or Remote Access VPN. If neither VPN type is in use on a given device, that device falls outside the advisory's stated scope for this particular flaw.
CVE-2026-85103: heap overflow in certificate decoding
CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoding flow, and Check Point's advisory states it may allow a remote attacker to execute arbitrary code on both the management server and the Security Gateway. ASN.1 is a standard format used to encode certificates; parsing it incorrectly is a well-known source of memory corruption bugs across many products, not just Check Point's.
Unlike CVE-2026-85103's sibling flaw, Check Point's product list for this one, Security Management Server, Security Gateway, and Spark Firewall, carries no Site-to-Site or Remote Access VPN qualifier. That lines up with a clarification a Check Point staff member gave in the company's community forum: asked whether gateways with the VPN software blade turned off entirely are still exposed to CVE-2026-85103, the reply was that the bug concerns certificate processing generally, so it could, in theory, be triggered even in an environment without VPN enabled, as long as VPN certificates are present on the system. Simply not using VPN on a given gateway does not automatically rule it out of this one.
| CVE-2026-85102 | CVE-2026-85103 | |
|---|---|---|
| CVSS Score | 9.8 (Critical) | 9.8 (Critical) |
| CWE | CWE-295 (Improper Certificate Validation) | CWE-122 (Heap-Based Buffer Overflow) |
| Root cause | Improper validation of certificate data during VPN negotiation | Heap overflow in the VPN certificate ASN.1 decoding flow |
| Affected products | Security Gateway, Spark Firewall using Site-to-Site or Remote Access VPN | Security Management Server, Security Gateway, Spark Firewall (no VPN-in-use qualifier) |
| Authentication required | No | No |
| Discovered by | Check Point (internal) | Check Point (internal) |
| Public PoC? | No, as of this writing | No, as of this writing |
| Known exploitation? | No, as of this writing | No, as of this writing |
Both CVSS scores were assigned by Check Point itself. Beyond the affected-product and version scoping above, Check Point has not publicly detailed the exact technical trigger conditions for either flaw, the kind of detail that would tell you precisely what a malicious certificate or negotiation attempt looks like. That is worth noting. It is common for vendors to withhold exploitation specifics to slow down attackers, but it also makes it harder for defenders to assess their own exposure with full precision. Until more detail is available, the safest working assumption is that any exposed, unpatched Check Point deployment matching the affected products and versions above should be treated as vulnerable.
Who is affected?
Check Point's advisories give identical affected-version lists for both CVE-2026-85102 and CVE-2026-85103:
| Product | Affected versions |
|---|---|
| Security Gateway, Security Management Server, Spark Firewall | R81.20, R82, R82.10 |
| Security Gateway, Security Management Server, Spark Firewall | R81.10.x, R82.00.x |
| Security Gateway, Security Management Server, Spark Firewall (end-of-support) | R80, R80.10, R80.20, R80.30, R80.40, R81, R81.10 |
R82.20 is confirmed not affected by either flaw.
The one distinction between the two CVEs is not which versions are affected, but which products the versions apply to. For CVE-2026-85102, Check Point's stated product scope is Security Gateway and Spark Firewall, and only when Site-to-Site VPN or Remote Access VPN is in use. For CVE-2026-85103, the scope is broader, covering Security Management Server, Security Gateway, and Spark Firewall, with no VPN-in-use condition attached. In practical terms: your Security Management Server needs to be patched for CVE-2026-85103 regardless of how your VPN is configured, while your gateways and Spark Firewalls need to be evaluated against both CVEs based on whether they are running VPN.
A separate advisory from the Canadian Centre for Cyber Security lists the same three product lines but does not include version numbers, so it is worth treating Check Point's own advisories (sk1000117 and sk1000118) as the authoritative source if you need to confirm a specific build.
End-of-support versions
Notice that R80, R80.10, R80.20, R80.30, R80.40, R81, and R81.10 are all named as affected, and all seven are past Check Point's official support window, meaning a patch is unlikely to be issued for them. If your organization is still running any of these, treat migration off the end-of-support branch as an urgent project in its own right, not just a patching exercise for this pair of flaws.
What should you do?
1. Patch through Jumbo Hotfix or Check Point Live Patch
Check Point has released fixes through two channels:
Check Point Live Patch (CPLP). If your organization already has Live Patch enabled, protection began rolling out automatically on September 9, 2026, and should apply without requiring a gateway reboot. Live Patch coverage is limited to R81.20, R82, and R82.10, and does not cover every configuration, so verify your protection status rather than assuming it applied. Check Point's Live Patch advisory (sk185114) has the details on checking coverage.
Jumbo Hotfix Accumulator. If Live Patch is not enabled, or your deployment falls outside its coverage, install the latest Jumbo Hotfix for your branch:
| Branch | Minimum fixed Jumbo Hotfix Take |
|---|---|
| R82.10 | Take 44 |
| R82 | Take 126 |
| R81.20 | Take 166 |
| Spark R82.00.10 | Build 2325 |
| Spark R81.10.17 | Build 4968 |
Locally managed Spark Firewall instances are not covered by Live Patch and must be updated manually to the builds above.
2. If you cannot patch immediately, apply the interim mitigation, but understand its limits
For Site-to-Site VPN deployments that cannot patch right away, Check Point recommends disabling implied rules for VPN and manually defining VPN access rules that restrict traffic on UDP ports 500 and 4500 to specific, known, trusted peer IP addresses.
This mitigation has real limits that your team should plan around:
- It does not apply to Remote Access VPN at all. There is currently no published interim mitigation for that configuration.
- It does not apply to locally managed Spark Firewall instances.
- Some customers managing Check Point deployments through community support channels have reported that the mitigation guidance, as written, is too vague to act on directly; questions about exactly which configuration lines to change, and how to apply the change without disrupting remote users, have gone unanswered in Check Point's own community thread as of this writing.
If your organization relies on Remote Access VPN and cannot patch quickly, the practical answer is that there is no clean substitute for patching. Prioritize those gateways accordingly.
3. Verify the patch actually reached you
Multiple organizations reported in Check Point's community forum that the automatic Live Patch rollout had not reached their gateways as of the days following disclosure, with several accounts describing gateways still running earlier Takes of Check Point's urgent update package rather than the fixed version. Others reported that the download links referenced in the advisories did not work for them, a claim Check Point staff disputed, saying the links had been tested and were functioning.
The practical lesson here is not to treat "we have Live Patch enabled" as equivalent to "we are patched." Check the running Take or build number on your gateways directly after the rollout window rather than assuming success.
4. Check your Security Management Server, not just your gateways
Because CVE-2026-85103 reaches the Security Management Server in addition to Security Gateway and Spark Firewall, make sure your patching plan explicitly includes management infrastructure. It is a common oversight to focus remediation entirely on internet-facing gateways while the management console, which is arguably a higher-value target for an attacker, gets addressed later or missed entirely.
A note on detection
Check Point has not published indicators of compromise for either vulnerability. Asked directly in the company's community thread whether existing logs would show past exploitation attempts, a Check Point staff member responded that the company has seen no evidence of external exploitation, and that indicators of compromise are typically only published once a working exploit is known to exist.
That leaves organizations with limited ability to retroactively confirm whether they were probed or targeted before patching. Given that, the priority is forward-looking: patch or mitigate now, monitor gateway and management server logs for unusual VPN negotiation failures or unexpected crashes going forward, and revisit detection guidance if Check Point publishes more specific indicators later.
Context: this has been a difficult year for Check Point VPN security
CVE-2026-85102 and CVE-2026-85103 are not related to two other Check Point vulnerabilities that were exploited in the wild earlier this year, but the pattern is worth knowing about when you are deciding how seriously to treat this disclosure.
In June, Check Point disclosed CVE-2026-50751, an authentication bypass in Remote Access VPN and Mobile Access certificate validation, which was already being exploited in Qilin ransomware attacks by the time it was announced. The U.S. Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog on June 8.
In July, Check Point patched CVE-2026-16232, a SmartConsole authentication bypass, which CISA added to the same catalog on the day it was disclosed. That flaw was one of three patched that month, two of which affected the Security Management Server, the same component CVE-2026-85103 reaches now.
CVE-2026-85102 and CVE-2026-85103 differ from those earlier cases in one important respect: Check Point found them proactively, through its own internal research, rather than in response to observed attacks. That is a genuinely better outcome. But given how quickly the two earlier, exploited vulnerabilities moved from disclosure to attacker use, and given the NCSC's explicit warning that exploitation attempts should be expected soon, treating this disclosure with the same urgency as an actively exploited one is the more prudent posture, not an overreaction.
Summary
| CVEs | CVE-2026-85102, CVE-2026-85103 |
| CVSS Score | 9.8 (Critical) for both |
| Type | CVE-2026-85102: improper certificate trust validation. CVE-2026-85103: heap-based buffer overflow in ASN.1 certificate decoding |
| Affected products | CVE-2026-85102: Security Gateway, Spark Firewall (Site-to-Site or Remote Access VPN in use). CVE-2026-85103: Security Management Server, Security Gateway, Spark Firewall (no VPN-in-use condition) |
| Affected versions | R81.20, R82, R82.10; R81.10.x, R82.00.x; end-of-support R80, R80.10, R80.20, R80.30, R80.40, R81, R81.10 |
| Not affected | R82.20 |
| Discovered by | Check Point (internal research team) |
| Public PoC? | No, as of this writing |
| Active exploitation? | No confirmed cases; Dutch NCSC expects exploitation attempts soon |
| Immediate mitigation | For Site-to-Site VPN only: disable implied VPN rules, restrict UDP/500 and UDP/4500 to trusted peer IPs. No mitigation exists for Remote Access VPN or locally managed Spark Firewall |
| Full fix | Check Point Live Patch (R81.20, R82, R82.10) or Jumbo Hotfix Accumulator: R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+, Spark R82.00.10 Build 2325+, Spark R81.10.17 Build 4968+ |
Check Point deserves credit for catching these internally before anyone else did. That does not change the calculus for your organization: two unauthenticated, remote, critical-severity flaws in VPN infrastructure, with a national cybersecurity agency warning that exploitation is coming, is a patch-today situation, not a patch-this-quarter one.
If you need help confirming whether your Check Point deployment received the fix, working through the Remote Access VPN gap where no mitigation currently exists, or reviewing your broader VPN and edge device exposure, get in touch. Edge VPN infrastructure has been a consistent target this year, and getting ahead of the next disclosure is worth the investment now.