Check Point Patches Two 9.8 VPN Certificate Flaws

Check Point has patched two critical vulnerabilities in the way its firewall and management products handle VPN certificates, the digital credentials used to secure a virtual private network tunnel, according to a customer notice published on September 9. Both flaws carry a CVSS score of 9.8, and Check Point says each could allow an unauthenticated remote attacker, meaning a person who can reach the product over the network without a valid username and password, to run code, but only under specific conditions that the vendor has not described. The fixes began rolling out the same day. Check Point reports that it found both issues internally and has seen no indication that either has been used in an attack.

The first flaw is CVE-2026-85102. The CVE record describes it as a failure to properly validate certificate trust during VPN negotiation. In plain terms, the product does not reliably confirm that a VPN certificate is legitimate before processing it, which may let an unauthenticated remote attacker run code on Check Point Security Gateway firewall appliances. The second flaw, CVE-2026-85103, is a heap-based buffer overflow that occurs while the product decodes the ASN.1 structure of a VPN certificate. ASN.1 is a standard notation used to describe the layout of certificates and other encoded data. A heap-based buffer overflow happens when a program writes more data than the reserved memory area can hold, a condition attackers can sometimes exploit to execute their own code. According to the CVE record, this flaw may allow an unauthenticated remote attacker to run code on Quantum Security Management and Quantum Security Gateway systems.

The CVE records list the same affected versions: R82.10 with Jumbo Hotfix Take 43 or below, R82 with Jumbo Hotfix Take 125 or below, and R81.20 with Jumbo Hotfix Take 165 or below. A Jumbo Hotfix is a cumulative package of software repairs that Check Point releases for its firewall and management products. These are the versions marked as affected, not the versions that contain the fix. The list covers three Quantum branches and gives no version information for anything else. A same-day advisory from the Canadian Center for Cyber Security lists a broader set of products but no versions at all: Security Gateway, Security Management Server, and Spark Firewall, Check Point's small-business line. Spark appears twice, once for deployments using Site-to-Site or Remote Access VPN and once without that condition. In the same community thread, a Check Point staff member was asked whether gateways with the VPN software blade turned off are affected by CVE-2026-85103. The staff member replied that the issue is about certificate processing, so it could, in theory, be triggered in an environment without a VPN but with VPN certificates present.

Check Point gave customers two routes to the fix. The first is Check Point Live Patch, a mechanism that automatically pushes security fixes without requiring a full software upgrade or reboot. The company says customers using it are protected automatically as the rollout begins, which started on September 9. A Check Point employee said in the thread that Live Patch can be installed on top of any Jumbo Hotfix level in R81.20, R82.00 and R82.10, and named only those three versions. The second route is the Jumbo Hotfix itself: Check Point told customers to install the latest one for their deployed version once it became available. Customers who cannot patch yet reported practical problems. Two customers said they are running R81.10 and will not be moving off it for weeks. One said no Jumbo Hotfix and no Live Patch was available for that branch, leaving mitigation as the only option. The same customer described the advisory's mitigation as turning off implied rules for VPN, called it too vague to act on, and asked which configuration lines to comment out. The other asked how to apply the mitigation without affecting remote users. Neither question had an answer in the thread. Several customers also said the automatic rollout had not reached them. Five separate accounts reported gateways were still on Take 18 or Take 17 of the urgent security update package on the day of the announcement. One posted an update log showing Take 18 installed on September 1 and nothing since. Download links in the two advisories did not work for some customers. A Check Point staff member replied that the links had been checked and were working. One customer said afterward that the advisory links still failed in two browsers, while the link in the Live Patch article worked.

The new flaws follow two other critical Check Point issues disclosed earlier in 2026 that were already being exploited when announced. In June, Check Point patched CVE-2026-50751, an authentication bypass in Remote Access VPN and Mobile Access certificate validation. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog on June 8. In July, Check Point patched CVE-2026-16232, a SmartConsole authentication bypass, which CISA added to the same catalog on the day it was disclosed. That July update included three flaws in total, two of which affected the Security Management Server, the same component that CVE-2026-85103 reaches. For the two new vulnerabilities, Check Point has not published indicators of compromise. Asked whether logs would show attempts to exploit them, a staff member said the company had seen no evidence of external exploitation, and that indicators of compromise only apply to exploits that already exist. Neither Check Point's notice nor any public record reviewed for this article states which Spark or Security Management versions are affected, which builds contain the fix, or what specific conditions the company says the flaws require. Nothing in that material addresses whether installing the fix removes access an attacker may already have obtained. Check Point's advisories sk1000117 and sk1000118 are the documents it points customers to for affected products, mitigation guidance, and remediation steps.

For website owners and IT teams, this story is a reminder that perimeter security devices like VPN gateways are high-value targets. A remote code execution flaw in a VPN can give an attacker a foothold into the network that hosts websites, databases and internal tools. Unpatched VPN certificates can be especially dangerous because they sit at the trust boundary between the internet and private systems. Organizations that run Check Point hardware or software should check their versions against the advisory immediately and move to a patched level as soon as practical. For teams that need help tracking and applying critical security updates across infrastructure, AEU-I, AEU Group's security-first IT and consulting service, offers infrastructure and security review work that can support patch verification and mitigation planning.