Check Point has patched two critical flaws in the way its firewall and management products process VPN certificates. Both bugs earn a CVSS score of 9.8—the highest possible before the 10.0 threshold reserved for trivially exploitable vulnerabilities—and the company acknowledges that an unauthenticated remote attacker could use them to run code on the affected appliances.
The first, CVE-2026-85102, is a failure to properly validate certificate trust during VPN negotiation. It affects Check Point Security Gateways, the firewall appliances organizations use to terminate VPN sessions. The second, CVE-2026-85103, is a heap-based buffer overflow triggered while the product decodes the ASN.1 structure of a VPN certificate; it reaches both the Security Gateway and the Security Management Server used to configure those appliances. Both vulnerabilities were discovered internally by Check Point, and the company says it has seen no evidence of exploitation in the wild. Fixes started rolling out on September 9, the same day Check Point disclosed the flaws.
A third product line, Spark Firewall—Check Point’s small-business offering—is also listed as affected, both in deployments using Site-to-Site or Remote Access VPN and in non-VPN configurations where VPN certificates are still present for certificate processing reasons.
How to check if you’re affected
Affected products include Quantum Security Gateway and Quantum Security Management Server running R81.10, R81.20, R82.00, or R82.10, plus Spark Firewall. Check Point delivered fixes through two channels:
- Check Point Live Patch — an automated rollout that started September 9. Customers on R81.20, R82.00, and R82.10 who have Live Patch enabled should receive protection automatically. Check your management console to confirm the patch has been applied.
- Jumbo Hotfix — manual installation for customers who prefer staged updates. Install the latest Jumbo Hotfix for your branch once it is available.
Customers running R81.10 should note that, as of the disclosure date, no Live Patch and no Jumbo Hotfix had been issued for that branch. Contact Check Point support for interim mitigation guidance. Turning off implied rules for VPN is mentioned in the advisory as a partial measure, but Check Point has not published step-by-step configuration instructions.
Check Point’s customer advisories sk1000117 and sk1000118 list the full set of affected products, mitigation steps, and remediation procedures.
Sources
- The Hacker News — Check Point Discloses Two 9.8-Rated VPN Certificate Flaws
- Check Point customer community advisories: sk1000117 and sk1000118 (available in Check Point’s support center)
- Canadian Centre for Cyber Security — alert published September 9, 2026