As reported by The Hacker News, Check Point has disclosed and patched two critical vulnerabilities in its firewall and management products' handling of VPN certificates — both carrying a CVSS 9.8 severity rating and enabling unauthenticated remote code execution.
VPN concentrators and perimeter firewalls remain among the most valuable targets for threat actors. A device that sits at the network boundary, terminates encrypted tunnels, and handles certificate validation is a compromise that effectively bypasses the entire security architecture. These two flaws — in certificate trust validation and ASN.1 parsing — represent the exact class of vulnerability that has been repeatedly weaponized across the industry.
Vulnerability Details
| CVE | CVSS | Type | Affected Products | Attack Vector |
|---|---|---|---|---|
| CVE-2026-85102 | 9.8 Critical | Improper certificate trust validation during VPN negotiation | Quantum Security Gateway | Unauthenticated remote |
| CVE-2026-85103 | 9.8 Critical | Heap-based buffer overflow in ASN.1 certificate decoding | Quantum Security Management Server, Quantum Security Gateway | Unauthenticated remote |
Affected Versions
The Canadian Center for Cyber Security advisory also lists Spark Firewall as potentially affected, broadening the scope beyond the Quantum line.
Patch Status
Patches are available and being delivered automatically via Check Point Live Patch (began September 9, 2026) for R81.20, R82, and R82.10. Manual Jumbo Hotfix updates are also available. No active exploitation has been observed — both flaws were discovered internally by Check Point.
Why This Matters
The security community should treat these flaws with urgency despite the absence of in-the-wild exploitation. History is instructive: similar unauthenticated RCE vulnerabilities in perimeter VPN appliances from Fortinet, Palo Alto Networks, and Ivanti were patched before public exploitation began, yet still resulted in mass compromise campaigns when organizations failed to patch quickly enough. The gap between advisory and weaponization can be measured in days.
Several factors compound the risk here:
- Internet exposure: Security Gateways are typically internet-facing by design, giving attackers a direct path to the vulnerable code.
- Management plane compromise: CVE-2026-85103 affecting the Security Management Server means an attacker could potentially control the central configuration console for an entire fleet of firewalls — a catastrophic scenario for enterprise environments.
- VPN blade not required: Check Point staff confirmed that CVE-2026-85103 could theoretically be triggered in environments without active VPN if VPN certificates are present, significantly expanding the attack surface beyond what administrators might assume.
- Two flaws, same code path: Two distinct vulnerability types (trust validation failure and heap overflow) in the same certificate processing subsystem suggests this is a complex, potentially fragile code area that may harbor additional issues.
Who Is at Risk
- Enterprises running Check Point Quantum Security Gateways or Management Servers on affected versions, especially those with internet-facing VPN endpoints
- Organizations using Spark Firewall for small-business or branch deployments
- Environments where the VPN blade is disabled but VPN certificates exist on the system
- Sectors with high-value targets: financial services, government, critical infrastructure, and any organization with publicly accessible VPN portals
Shield53 Recommendations
Immediate Actions
- Apply patches now. If using Check Point Live Patch, verify the automatic rollout has completed. If using Jumbo Hotfix updates, apply them immediately and confirm the Take level exceeds the affected thresholds listed above.
- Inventory all Check Point appliances. Identify every Security Gateway, Security Management Server, and Spark Firewall in your environment. Include branch offices and forgotten appliances that may not be in your primary asset management system.
- Verify VPN blade status. Even gateways with the VPN blade disabled may be vulnerable to CVE-2026-85103 if VPN certificates are present. Do not assume disabling the blade eliminates risk.
- Restrict management access. Ensure Security Management Server interfaces are not reachable from the internet. Use Jump hosts, VPN, or dedicated management networks.
- Enable logging and review. Check for anomalous certificate negotiation attempts or unexpected crashes in VPN daemon logs. Heap overflows may cause crashes before successful exploitation — repeated crashes on a gateway could indicate probing.
- Check for indicators of compromise. Review gateway and management server logs for unusual process execution, unexpected outbound connections, or modifications to security policy that no authorized administrator made.
Longer-Term Hardening
- Adopt a continuous patching cadence for all perimeter appliances — not just for critical advisories. Jumbo Hotfixes should be tracked and applied on a regular schedule.
- Implement network segmentation so that compromised management servers cannot pivot laterally.
- Maintain an offline backup of firewall configurations to enable rapid recovery if a management server is compromised.
The combination of internet exposure, unauthenticated exploitation, and potential management-plane compromise makes this one of the more significant perimeter appliance disclosures of 2026. Organizations that delay patching based on the absence of active exploitation are making a bet against historical precedent — and the house usually wins.
