Check Point disclosed two 9.8-rated flaws on September 9, 2026, that could let an unauthenticated remote attacker run code through VPN certificate processing. A Check Point staff member said one of them could, in theory, be triggered on systems with no VPN running.
Key Takeaways
- Check Point rates both CVE-2026-85102 and CVE-2026-85103 at 9.8 on the CVSS scale and says it found them internally.
- Affected builds are R82.10 with Jumbo Hotfix Take 43 or below, R82 with Take 125 or below, and R81.20 with Take 165 or below.
- One R81.10 customer said that branch has no hotfix or Live Patch and called the fallback mitigation too vague.
- Check Point says it has seen no exploitation and has published no indicators of compromise for either flaw.
What We Know?
CVE-2026-85102 is a failure to validate certificate trust during VPN negotiation, and its record warns of code execution on the Quantum Security Gateway. CVE-2026-85103 is a heap-based buffer overflow in the ASN.1 decoding of VPN certificates. That one reaches both Quantum Security Gateway and Quantum Security Management systems, and Check Point assigned both IDs and scores itself.
The company’s CheckMates notice says the bugs “could potentially allow unauthenticated remote code execution under specific conditions” but never names those conditions. The Canadian Centre for Cyber Security adds Spark Firewall, Check Point’s small-business line, to the affected products without listing versions.
‼️ Check Point patched two critical VPN certificate flaws, CVE-2026-85102 and CVE-2026-85103, that could allow unauthenticated RCE under specific, undisclosed conditions.
— The Hacker News (@TheHackersNews) September 10, 2026
Both carry CVSS 9.8 scores.
What’s affected and how to fix it: https://t.co/nPjElpoGTs
Why Management Servers Need the Patch?
Turning off the VPN blade isn’t a safe exit. A Check Point staff member said CVE-2026-85103 involves certificate processing, so it could theoretically fire where VPN is off but VPN certificates are present.
A community admin put it more bluntly: “the second CVE is about certificate handling, and considering all MGMT servers have CPCA, they have to be patched.” CPCA is Check Point’s internal certificate authority, which puts every Security Management Server inside that warning.
Patch Delivery Leaves Gaps
Check Point offers two routes, Live Patch and the latest Jumbo Hotfix for each version. A company employee said Live Patch installs on any Jumbo Hotfix level of R81.20, R82.00 and R82.10, and those were the only branches named.
The automatic rollout hasn’t reached everyone. Five accounts in the thread said their gateways still sat on Take 17 or Take 18 of the urgent update package on announcement day.
R81.10 users are further behind. One asked which lines of implied_rules.def to comment out to disable implied rules for VPN, and another asked how to apply the mitigation without affecting remote users, but neither question had an answer in the thread.
What We Don’t Know?
- What “specific conditions” do the flaws require?
- Which Spark and Security Management versions are affected?
- Which builds actually contain the fix?
- Does patching remove access an attacker may already hold?
SQ Magazine’s Takeaway
This disclosure lands on a product line with a fresh record. In June, CISA added CVE-2026-50751, an authentication bypass in Check Point’s VPN certificate validation, to its Known Exploited Vulnerabilities catalog, and July brought CVE-2026-16232, an exploited SmartConsole bypass. Management consoles have carried critical bugs at other vendors too, including a 10.0-rated Cisco Secure Firewall Management Center flaw.
What’s next: admins on R81.20 and later should confirm Live Patch actually installed, and one community advisor suggested searching audit logs for “live patch” to check. Management servers need the fix even with VPN off.
