Check Point has patched two critical vulnerabilities in the way its firewall and management products handle VPN certificates, both rated CVSS 9.8 by the vendor and both allowing an unauthenticated remote attacker to execute code "under specific conditions" that Check Point has declined to describe.
| Attribute | Detail |
|---|---|
| CVEs | CVE-2026-85102 (certificate trust validation), CVE-2026-85103 (ASN.1 heap overflow) |
| CVSS | 9.8 each (vendor-assigned) |
| Products | Security Gateway; Quantum Security Management Server; Spark Firewall (per CCCS advisory) |
| Affected builds | R82.10 (Take ≤43), R82 (Take ≤125), R81.20 (Take ≤165) |
| Remediation | Check Point Live Patch and Jumbo Hotfix, both rolling from 2026-09-09 |
| Exploited | No exploitation observed as at 2026-09-10; NCSC-NL assessed exploitation as imminent on 2026-09-12 |
Check Point says it found both flaws itself and has published no indicators of compromise. The rollout has been uneven in practice: customers on the R81.10 branch reported in the vendor's own community thread that neither Live Patch nor a Jumbo Hotfix was available to them, leaving the advisory's vaguely worded VPN implied-rules mitigation as the only option, while several other customers reported the automatic rollout had not reached their gateways and others reported broken download links in the advisories. A vendor staff member noted that CVE-2026-85103 concerns certificate processing, so it could in principle be triggered without VPN enabled where VPN certificates are present. The vendor has not stated which Spark or Security Management versions are affected, which builds contain the fix, what the "specific conditions" are, or whether installing the fix removes access an attacker may already hold. See cve-2026-85102.md and cve-2026-85103.md.
Escalation — 2026-09-12: NCSC-NL warns exploitation is imminent
The Dutch national cyber security centre (NCSC-NL) has warned that exploitation of both flaws is expected soon and told organisations to install the updates immediately, assessing both the likelihood of exploitation and the potential impact as high despite no public proof-of-concept exploit having been reported. The agency states that successful exploitation could give an attacker full control of a system, allow confidential data to be viewed or modified, and disrupt operations. Alongside patching, NCSC-NL advises operators using the Site-to-Site VPN component to modify VPN rules so peers are restricted to specific, trusted IP addresses. Check Point's LivePatch protections (Take 24 for R81.20, R82 and R82.10) are reported to have reached Check Point Live Patch users since 9 September without requiring a server reboot, but CPLP covers only those three branches and not all configurations, so users are advised to confirm they are actually protected rather than assume it. Version R82.20 is not affected by either flaw.
Escalation — 2026-09-24: Check Point confirms active exploitation of CVE-2026-85102
The exploitation NCSC-NL warned was imminent on 12 September has now been confirmed by the vendor. Check Point says it has observed active exploitation of CVE-2026-85102 — the certificate-handling RCE in the Security Gateway VPN — with malicious activity beginning 12 September 2026 against Spark customers, originating from anonymisation infrastructure including VPN services and proxies. The company also confirmed exploitation of the management pre-authentication path traversal CVE-2026-93616, used as a zero-day since 23 July 2026; both flaws now sit in CISA's KEV catalog with a 25 September 2026 remediation deadline for US federal agencies.
Check Point published the certificate subjects seen in the exploitation attempts, which are directly useful as detection content:
CN=vpn,OU=users,O=globalCN=vpn-user,OU=users,O=globalCN=vpnuser,OU=users,O=global
The vendor cautions that these reflect current observations only and that further subjects may be in use. Fixes are LivePatch Take 26 on supported R81.20, R82 or R82.10 gateways, or Jumbo Hotfix R81.20 Take 166, R82 Take 126, R82.10 Take 44 or R81.10 Take 190 (or later); Spark firewalls need R82.00.10 Build 2325 or R81.10.17 Build 4968. Administrators can confirm LivePatch is active by running cpinfo -y CPupdates in expert mode on the Security Gateway. The two-day gap between the national CERT warning and observed exploitation of a pre-authentication edge flaw is the planning figure worth carrying forward.