Check Point Sounds Third Critical Alert in Four Months: Two VPN Flaws Enable Unauthenticated RCE

Check Point published two security advisories on September 9, 2026 for critical vulnerabilities in its VPN products, both carrying a CVSS 9.8 score and the potential for unauthenticated remote code execution. This is the third critical patch cycle in four months: June and July 2026 had already demanded similar interventions on perimeter gateways. The difference this time lies in the combination of technical severity and the operational fracture between supported versions, which receive automatic fixes, and End-of-Support versions, which are left exposed.

The two flaws, identified as CVE-2026-85102 and CVE-2026-85103, were discovered internally by the vendor. According to the official advisories sk1000117 and sk1000118, there is no evidence of in-the-wild exploitation. The gap between the theoretical risk severity and the actual protection of customers on slow update cycles defines the operational problem at hand.

The Mechanisms: Two Errors in the VPN Certificate Chain

The two vulnerabilities affect distinct phases of certificate processing in VPN tunnels, but share the same attack profile: remote access, no authentication required, maximum impact on confidentiality, integrity, and availability.

CVE-2026-85102, described in advisory sk1000117, resides in "improper validation of certificate data during VPN negotiation." The defect allows an unauthenticated remote attacker to execute arbitrary code on the Security Gateway. The mechanism is classified as CWE-295.

"Improper validation of certificate data during VPN negotiation may allow an unauthenticated remote attacker to execute arbitrary code on the Security Gateway." — Check Point advisory sk1000117

CVE-2026-85103, documented in sk1000118, is a "heap overflow in the VPN certificate ASN.1 decoding flow." This second flaw expands the attack surface: in addition to the Security Gateway, it also affects the Security Management Server. The defect is classified as CWE-122.

A layer of complexity emerges from a community discussion reported by The Hacker News: CVE-2026-85103 might theoretically be triggerable even in environments where the VPN blade is not active, provided VPN certificates are present in the system. Check Point has neither confirmed nor explicitly denied this condition in the primary advisories.

Versions in the Crosshairs: Supported, Patched, Abandoned

The affected-version map draws a sharp line between who is covered and who is not. Permanent fixes arrive with the Jumbo Hotfix Accumulator starting at Take 44 for R82.10, Take 126 for R82, and Take 166 for R81.20. For Spark Firewall, the corrected builds are R82.00.10 Build 2325 and later, and R81.10.17 Build 4968 and later.

The in-memory mitigation via Check Point Live Patch (CPLP) is available with BUNDLE_URGENT_SECURITY_UPDATE take 24, with rollout initiated on September 9, 2026. The Live Patch does not require a reboot but is temporary: it blocks immediate exploitability until the permanent Jumbo Hotfix is applied.

The operational fracture concerns End-of-Support versions: R80, R80.10–R80.40, R81, R81.10. For these, Check Point will not release patches. Some customers on R81.10 have reported, according to The Hacker News, the absence of available hotfixes in their consoles. The dossier does not clarify whether this reflects a distribution delay or a programmatic exclusion.

For versions covered by a manual fix, Check Point recommends disabling implied VPN rules and manually defining access on UDP/500 and UDP/4500 for specific peer IPs. This mitigation does not apply to locally managed Spark Firewalls.

The Critical Cadence: June, July, September 2026

The context that makes this advisory more than a single patch is the recurrence. Check Point has already managed critical cycles in June and July 2026, always on VPN and perimeter components. The concatenation of three events in four months, all with potential for unauthenticated initial access, configures a systemic risk profile for administrators managing these gateways.

The architectural choice to concentrate VPN, firewall, and management functions on integrated platforms, historically a vendor strength, amplifies the impact surface here. A pre-authentication RCE on a perimeter VPN gateway represents one of the most dangerous initial-access vectors in the current landscape: it bypasses internal network controls, directly exposes infrastructure, and provides a foothold for lateral movement.

The primary advisories do not document whether patch installation removes access already obtained by an attacker. This limitation is relevant for risk assessment: an administrator who patches today cannot assume they have closed a compromise that began yesterday.

Immediate Actions

Verify the version and Jumbo Hotfix availability. For R82.10, R82, and R81.20, confirm the system reports at least Take 44, Take 126, or Take 166 respectively. According to official release notes, these are the first accumulators containing the permanent fix.

Apply the CPLP Live Patch take 24 if the Jumbo Hotfix cannot be installed immediately. The mechanism has been active since September 9, 2026 and provides in-memory mitigation without a gateway reboot.

Evaluate the manual mitigation for Site-to-Site VPN deployments. Disable implied VPN rules and explicitly define access on UDP/500 and UDP/4500 for authorized peer IP addresses. This action does not apply to locally managed Spark Firewalls.

Plan transition for EoS versions. R80, R80.10–R80.40, R81, and R81.10 receive no patches. The permanent exposure of these versions, typically placed on internet-facing network perimeters, demands an architectural decision: upgrade, additional segmentation, or platform replacement.

The Gap Between Disclosure and Actual Protection

The September 2026 Check Point case shows a pattern that runs through the perimeter security industry: vendor disclosure speed often outpaces the operational capacity of those who must apply patches. The Live Patch mitigates the gap but does not close it: it is temporary, still requires an update cycle, and does not cover out-of-support versions.

The internal discovery of the flaws is a positive signal for the maturity of Check Point's security process, but it does not lower the risk for customers. The absence of in-the-wild exploitation, confirmed by primary sources, offers a time window that administrators must treat as contingent: the technical conditions for exploitation exist, and the advisory's publication can accelerate reverse engineering.

Check Point has not published a PoC, nor detailed the specific exploitability conditions. This is consistent with responsible disclosure practice, but leaves defenders without an independent way to verify whether their systems are technically exposed rather than merely theoretically vulnerable. Risk assessment remains, at this stage, a function of trust in the vendor.

Sources

• https://www.securityweek.com/check-point-patches-critical-vpn-vulnerabilities/
• https://thehackernews.com/2026/09/check-point-discloses-two-98-rated-vpn.html
• https://s-edv.com/news/check-point-vpn-zertifikat-cve-2026-85102-85103-cvss-98
• https://bellatorcyber.com/blog/check-point-patches-critical-vpn-vulnerabilities
• https://www.hendryadrian.com/check-point-discloses-two-9-8-rated-vpn-certificate-flaws-enabling-unauthenticated-rce/
• https://gbhackers.com/critical-check-point-vpn-flaws/
• https://support.checkpoint.com/results/sk/sk1000117
• https://support.checkpoint.com/results/sk/sk1000118
• https://support.checkpoint.com/results/sk/sk185114
• https://podcast.securityweek.com/

Information verified against cited sources and current as of publication.

Sources

• https://schema.org/FAQPage
• https://schema.org/Question
• https://schema.org/Answer