Check Point Patches Two 9.8-Severity VPN Flaws That Allow Unauthenticated Code Execution

Check Point released emergency updates on 9 September for two critical vulnerabilities in the certificate handling of its VPN products, flaws that would let an unauthenticated attacker run code on a firewall or management server sitting at the edge of a corporate network.

Related reading: WordPress Patches Comment2Shell, a Comment Flaw That Can Lead to Server Takeover · Oracle Ships 673 Security Patches, Including Six Maximum-Severity Flaws.

Both bugs carry a CVSS score of 9.8, the maximum severity rating, and both can be triggered remotely without credentials. The first, tracked as CVE-2026-85102, is an improper validation of certificate data during VPN negotiation. The second, CVE-2026-85103, is a heap-based buffer overflow in the ASN.1 decoding of VPN certificates. Check Point published advisories sk1000117 and sk1000118, and the European Union's CERT-EU issued its own alert.

The products affected are Check Point Security Gateway, Security Management Server and Spark Firewall, across the R81.20, R82 and R82.10 release trains configured for Remote Access VPN or Site-to-Site VPN. Check Point said the newer R82.20 branch is not affected. Because these appliances manage firewall policy and terminate VPN tunnels, a successful compromise does not just expose one device: it can hand an attacker a foothold at the network perimeter and a path toward internal systems and the management console that controls every gateway in the estate.

Why certificate parsing is the weak point

Both flaws sit in the part of the VPN handshake that runs before a user's identity is verified. To establish a tunnel, the gateway must parse and validate a certificate presented by the other side. That parsing happens early, and on a reachable network port, which is exactly the combination attackers look for in an internet-facing appliance.

In CVE-2026-85102, the gateway fails to properly establish the trust of a presented certificate, allowing an unauthenticated attacker to advance the negotiation far enough to execute code. In CVE-2026-85103, a specially crafted certificate corrupts heap memory inside the ASN.1 decoder, giving the attacker control of execution on both Security Gateways and Security Management Servers. Armis, which tracks the second flaw, notes that the vulnerable versions are R82.10 with Jumbo Hotfix Take 43 or earlier, R82 with Take 125 or earlier, and R81.20 with Take 165 or earlier.

The distinction between the two matters for administrators. CVE-2026-85102 affects Security Gateways and Spark Firewalls used for VPN. CVE-2026-85103 reaches the management plane as well, meaning a single malformed certificate could compromise the console that provisions policy across an organization's firewalls.

Who is exposed, and how urgently

Check Point said both vulnerabilities were found internally and that it has no indication they have been exploited. It also said no public proof-of-concept code existed at the time of disclosure. That is a starting position, not a permanent one.

The Dutch National Cyber Security Centre assessed the likelihood of exploitation and the potential impact as high, and said on 10 September that it expected exploitation attempts to appear soon. The reasoning is standard for this class of bug: an unauthenticated, remotely reachable remote code execution flaw in a perimeter appliance is attractive to ransomware crews and state-linked groups, and history suggests the window between disclosure and exploitation is short. The GitLab path-traversal flaw patched the day after Check Point's update was already being probed within hours, a reminder of how fast the scanning cycle moves.

Check Point discovered both issues itself. That is a good sign for the company's internal testing, but it also means the public has had no chance to independently assess how difficult the flaws are to trigger, and no proof-of-concept has circulated to give defenders a way to test their own exposure.

Fixed versions and workarounds

For supported branches, the fixed states are R82.10 Jumbo Hotfix Take 44 or later, R82 Take 126 or later, and R81.20 Take 166 or later. Spark Firewall fixes are included in R82.00.10 Build 2325 or later and R81.10.17 Build 4968 or later. Customers with Check Point LivePatch enabled should receive the fixes automatically; the company began the LivePatch rollout on 9 September. Administrators who have not verified that the patch actually installed should not assume the automatic path worked, and should check the installed hotfix or LivePatch state against the advisory.

Where immediate patching is not possible, Check Point recommends a temporary reduction in exposure for Site-to-Site VPN: disable the implied rules for VPN and manually define VPN access for UDP port 500 and UDP port 4500 that is limited to specific peer IP addresses. The company cautions that this mitigation does not apply to Remote Access VPN, and that there is no workaround for locally managed Spark Firewall instances, which should be patched as soon as possible.

Those restrictions are a stopgap, not a fix. Any peer address that is still allowed to reach the VPN port can still deliver the malformed certificate, so narrowing the allowlist reduces the attack surface without closing the vulnerability.

The bigger pattern

The Check Point disclosure lands in a crowded month for network-perimeter security. Cisco Talos reported that three separate threat clusters had exploited two Secure Firewall Management Center flaws, including a maximum-severity authentication bypass, with one cluster tied to Qilin ransomware affiliates and another to a group whose tooling overlaps with the Sandworm APT. CISA added five other actively exploited flaws to its Known Exploited Vulnerabilities catalog, covering JFrog Artifactory, ConnectWise ScreenConnect and MikroTik RouterOS. And GitLab's CVSS 10.0 path-traversal bug was being probed within a day of its patch.

Taken together, the pattern is familiar: the appliances organizations rely on to enforce trust at the network edge are themselves becoming the target, because compromising one yields access to everything behind it. VPN concentrators are especially valuable because they sit on the public internet by design and because their users expect them to be reachable.

How attackers find exposed gateways

The practical risk from a flaw like this depends less on its CVSS score than on how many affected devices are reachable from the internet and how quickly an exploit appears. Both conditions tend to favour the attacker. Internet-wide scanning services index VPN portals continuously, and a gateway that advertises its vendor and version on a login page is straightforward to catalogue. Once a patch is published, the same services let an attacker filter for unpatched devices, and the gap between disclosure and weaponisation is often measured in days.

Perimeter appliances have become a preferred initial-access vector for that reason. Recent years have seen sustained campaigns against VPN and edge devices from Ivanti, Fortinet, Citrix, Palo Alto Networks and Cisco, with nation-state groups and ransomware affiliates both treating them as a way into networks that are otherwise well defended. A successful compromise of a management server is worse still: it can give an attacker the ability to push policy, trust new certificates and reach every gateway the server controls.

Patching these devices is harder than it looks. They sit in change-controlled environments where downtime requires a maintenance window, they often run in high-availability pairs that must be updated one at a time, and many are managed locally by regional teams without a central inventory. Appliances also generate far less security telemetry than endpoints, so a breach may leave few obvious traces. Check Point's own advice to verify that the automatic LivePatch actually installed reflects how often a claim of having patched turns out to mean the update was merely scheduled.

The combination of high value, fast weaponisation and slow remediation is why regulators and incident-response firms treat edge vulnerabilities as urgent even before exploitation is confirmed. For attackers, an unpatched gateway is often the cheapest path to a foothold, and for defenders it is frequently the last device anyone remembers to update.

What to do

Check Point customers should inventory their gateways, management servers and Spark appliances, record the exact release and installed hotfix take, and confirm against the vendor advisories whether each device is affected. Devices on a fixed take should be documented as remediated. Devices on an affected take, with LivePatch not confirmed installed, should be updated through the supported Jumbo Hotfix path for their branch.

Longer term, the episode reinforces a case for limiting what a VPN appliance is allowed to expose. Restricting management interfaces to a segregated network, enforcing multi-factor authentication even where certificates are used, and monitoring certificate-parsing errors for signs of probing all reduce the blast radius if a patch is late. None of those controls substitutes for updating an appliance with a 9.8-rated, pre-authentication flaw. But they are what turns a perimeter breach from a network-wide incident into a contained one.

The immediate action is unglamorous and time-sensitive: patch, verify the patch installed, and do not wait for a proof-of-concept to appear before treating the flaws as urgent.