Check Point has patched two maximum-severity vulnerabilities in the certificate-processing code behind its VPN products, and the Dutch Nationaal Cyber Security Centrum (NCSC) is already telling organizations to treat exploitation as imminent — despite Check Point’s own research team finding no evidence of active attacks or public proof-of-concept code at disclosure time. Both bugs are unauthenticated, remotely triggerable, and score a full CVSS 9.8.

What happened

CVE-2026-85102 and CVE-2026-85103 sit in how Check Point’s Security Gateway, Security Management Server, and Spark Firewall products validate and parse X.509 certificates during VPN negotiation. Because certificate handling runs before any credential check, both flaws are reachable by anyone who can send traffic to an exposed VPN endpoint — no account, no prior session, no user interaction.

Check Point found the bugs internally, not through incident response, and began shipping fixes via Live Patch and Jumbo Hotfix Accumulator on September 9. Three days later, the Dutch NCSC issued an urgent advisory rating both the likelihood and impact of exploitation as high, and said it expects attacks “soon” — a notable escalation for a vendor-discovered bug with no known in-the-wild activity yet. Edge VPN concentrators from Check Point, Citrix, Fortinet, Ivanti, and Palo Alto have all shipped actively exploited pre-auth RCE bugs in 2026, so defenders and researchers alike are primed to expect a short window between disclosure and weaponization.

Technical details

  • CVE-2026-85102 (CWE-295, improper certificate validation): During VPN negotiation, the gateway fails to properly validate the trust chain of a presented certificate. An attacker who can reach a Remote Access VPN or Site-to-Site VPN endpoint can abuse this to push negotiation into a state that results in arbitrary code execution on the Security Gateway. Documented in Check Point advisory sk1000117.
  • CVE-2026-85103 (CWE-122, heap-based buffer overflow): A heap overflow in the ASN.1 decoding routine used to parse VPN certificates. Sending a malicious certificate structure to a listening gateway triggers memory corruption that can be leveraged for remote code execution. This one also reaches the Security Management Server, not just gateways — meaning a compromised management server can cascade to every gateway it administers. Documented in advisory sk1000118.

Affected products: Check Point Security Gateway, Security Management Server, and Spark Firewall, across the R81.20, R82, and R82.10 branches, when Site-to-Site VPN or Remote Access VPN is enabled.

Impact

Both bugs require zero authentication and no user interaction — an attacker only needs network reachability to a VPN-enabled interface. Check Point gateways are, by design, internet-facing edge devices terminating remote-access and site-to-site tunnels, so exposure is the default deployment posture rather than a misconfiguration. A successful exploit gets code execution directly on the gateway or management server, which sits at the perimeter of the internal network and, in the management-server case, controls policy for every downstream firewall. CERT-EU has independently urged all organizations running affected Check Point products to patch immediately, and the Dutch NCSC’s advisory carries the same urgency as a live-exploitation warning even though this is technically a proactive disclosure.

Mitigation

  1. Apply the fix now, don’t wait for a KEV listing. Organizations running Check Point Live Patch get the protection automatically — rollout began September 9 (Take 24). Everyone else must manually install the current Jumbo Hotfix Accumulator: R82.10 Take 44+, R82 Take 126+, or R81.20 Take 166+ (take numbers per branch — confirm current minimums against sk1000117/sk1000118).
  2. Verify Live Patch actually applied. Don’t assume automatic rollout reached every gateway; confirm hotfix version on each managed device, especially any built or restored recently.
  3. Treat the Security Management Server as in-scope, not just gateways. CVE-2026-85103 reaches SmartCenter/management servers directly — patch those with the same priority as edge gateways.
  4. Watch for anomalies even pre-exploitation. Given the NCSC’s imminent-exploitation assessment, review VPN gateway logs now for malformed certificate submissions, unexpected crashes/restarts of VPN daemons, and any negotiation attempts from unfamiliar client certificates, so a baseline exists if attacks start this week.

References