Check Point disclosed two critical vulnerabilities on 9 September 2026 and began shipping fixes the same day. Both score 9.8. Both can let an unauthenticated remote attacker run code. And both live in the same place: the code that handles VPN certificates.

The company says its own research team found them, and that it has no indication either has been used in an attack. There is no public proof of concept.

Two flaws, one path

CVE-2026-85102 is described in Check Point's advisory sk1000117 as "Improper validation of certificate data during VPN negotiation may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway." It affects the Security Gateway and Spark firewalls, and requires a Site-to-Site VPN or Remote Access VPN blade to be enabled. Exploitation happens during certificate negotiation — before authentication.

CVE-2026-85103, in sk1000118, is "A heap overflow in the VPN certificate ASN.1 decoding flow may allow a remote attacker to remotely execute arbitrary code." Its reach is wider: the Security Management Server as well as gateways and Spark.

CVE-2026-85102 breaks the trust decision: improper validation of certificate data during VPN negotiation, on Security Gateways and Spark. CVE-2026-85103 breaks merely reading the certificate: a heap overflow in ASN.1 decoding that also reaches the Security Management Server. Both are 9.8, and both run before authentication, so between them they cover both halves of certificate handling.

The credential is read before anyone has proved anything

This is the structural point, and it applies well beyond Check Point.

A certificate is what a VPN peer presents to prove who it is. To evaluate that proof, the gateway has to do 3 things with it — receive it, decode it and check it — all before it knows whether the sender is anyone at all. By design, certificate processing is pre-authentication attack surface. The mechanism that establishes trust is, necessarily, code that runs on untrusted input.

And the decoding step is ASN.1, a data format with a long record of parser bugs across the industry, precisely because it is flexible, deeply nested and length-prefixed in ways that reward a careful attacker.

F5's BIG-IP web shell showed the same class of device from another angle: the edge appliance is where unauthenticated input arrives first, and one parsing mistake there is a way in rather than a crash.

The management server does not need the VPN turned on

The detail most likely to be missed is in CVE-2026-85103.

Asked about environments without the VPN blade, a Check Point staff member said, as reported by The Hacker News, that the issue "is about certificate processing, so it could, in theory, be triggered in an environment without a VPN but with VPN certificates present."

That matters most for the Security Management Server — the console that holds policy for every gateway it manages. It is not a VPN endpoint, but it handles VPN certificates. The attack surface here is not the feature you enabled. It is material that exists on the box because of features enabled somewhere else.

Which versions, and which ones get nothing

Affected and supported: R81.20, R82 and R82.10. Fixed in Jumbo Hotfix Accumulator R82.10 Take 44, R82 Take 126 and R81.20 Take 166 or later. Spark fixes are R82.00.10 build 2325 and R81.10.17 build 4968 or later. R82.20 is not affected.

Customers with LivePatch enabled were protected automatically as the rollout began on 9 September — the best possible outcome, requiring no action. Everyone else has a manual patch window.

End-of-support releases get no fix at all. Both advisories list 7 of them as affected — R80, R80.10, R80.20, R80.30, R80.40, R81 and R81.10 — and for those the only remediation is an upgrade. Firewalls are exactly the class of device that stays on an old release for years, because it works and nobody wants the outage. If yours is one of them, this is the notice that it is no longer a stable choice.

The workaround, and where it does not help

For Site-to-Site VPN, Check Point's mitigation is to disable the implied VPN rules and manually allow UDP/500 and UDP/4500 only from the specific peer IP addresses you expect. That narrows who can reach the certificate parser to peers you already know.

It does nothing for Remote Access VPN, where the entire point is that peers arrive from anywhere.

What to do

  • Check whether LivePatch is enabled. If it is, confirm the rollout reached every gateway; if not, install the Jumbo Hotfix for your branch.
  • Patch the Management Server too. CVE-2026-85103 reaches it, and it may not need a VPN blade to be exposed.
  • Treat R80 to R81.10 as permanently unpatched and schedule the upgrade.
  • Apply the implied-rules workaround for Site-to-Site VPN where patching has to wait, restricting UDP/500 and UDP/4500 to known peers.
  • Watch for exploitation reports. Check Point found these itself, but fixes are now public, and fixes can be compared against what came before.

What is not established

  • The full conditions under which CVE-2026-85103 is reachable without a VPN blade. "In theory" is the only public statement.
  • Whether exploitation follows now that fixes are available to study.
  • How many gateways still run end-of-support releases. Check Point has not said.
  • Whether LivePatch coverage is complete across every affected branch and appliance model.