Check Point patches two CVSS 9.8 flaws in its VPN certificate handling

September 9, 2026. Check Point ships a fix for two flaws in how its firewalls and management console handle VPN certificates. September 10, 2026. The two identifiers — CVE-2026-85102 and CVE-2026-85103 — surface with a CVSS 9.8 score each. September 12, 2026. The Dutch NCSC publishes a warning that exploitation is “imminent.” In three days, two unknown certificate bugs became a perimeter emergency — and it is the third time in four months that Check Point’s VPN certificate handling has come back to the table.

Two twin flaws in certificate handling

Both vulnerabilities sit in the same layer: the code that validates certificates exchanged during VPN negotiation. They remain distinct in their mechanism.

CVE-2026-85102 is a failure to properly validate certificate trust during VPN negotiation. Its CVE record says an unauthenticated remote attacker may be able to run code on the Security Gateway. The operative word is “trust”: the component does not correctly verify what it accepts as a legitimate certificate, which opens the door to a forged one.

CVE-2026-85103 is a heap-based buffer overflow triggered while decoding the ASN.1 structure of a VPN certificate. Its record says an unauthenticated remote attacker may be able to run code on Quantum Security Management and Quantum Security Gateway. Here the problem is not trust but parser robustness: a malformed ASN.1 structure overflows the buffer and hands over control.

Check Point assigned both identifiers and the 9.8 scores itself — the top of the scale, reserved for flaws exploitable without interaction or authentication. The company says it found both internally and has “no indication” either has been used in an attack. That is reassuring, but the fix is landing while the exploitation window is still open to anyone who can read an advisory.

A perimeter that extends beyond the VPN

The affected product range goes beyond the firewall itself. The Canadian Centre for Cyber Security advisory, published the same evening, lists a broader set than the CVE records: Security Gateway, Security Management Server, and Spark Firewall, the small-business line. Spark appears twice, depending on whether the deployment uses site-to-site or remote-access VPN.

One detail from Check Point’s customer thread makes the situation more uncomfortable. Asked whether CVE-2026-85103 affects a box whose VPN blade is turned off, a staff member replied that the issue is about certificate processing, so it could in theory be triggered in an environment with no VPN but with VPN certificates present. In other words, disabling the VPN blade may not shelter you: the attack surface lives in the certificates themselves, not in the service that consumes them.

The versions listed as affected cover three Quantum branches: R82.10 (Jumbo Hotfix Take 43 or below), R82 (Take 125 or below), and R81.20 (Take 165 or below). No version information is given for the rest of the catalog, which forces teams to verify their own patch level rather than rely on a closed list.

A surface that keeps recurring

The most important point is not technical, it is statistical. In June 2026, Check Point patched CVE-2026-50751, an authentication bypass in Remote Access VPN and Mobile Access certificate validation, already exploited when announced — CISA added it to the KEV catalog on June 8. In July 2026, Check Point patched CVE-2026-16232, a SmartConsole authentication bypass, added to KEV the day it was disclosed, and which reached the Security Management Server — the same component CVE-2026-85103 hits today.

Three episodes, four months, one family: certificate validation and the management console. That is no longer a coincidence, it is a pattern. When a security vendor comes back three times to the same layer, the signal for a CISO is clear: certificate handling has become, at Check Point, a surface to audit continuously — not a component you patch once and forget.

Patching: Live Patch or Jumbo Hotfix

Check Point offers two routes to the fix. The first is the Live Patch, pushed automatically to customers who use it, with rollout starting on September 9. A staff member notes in the thread that it installs on top of any Jumbo Hotfix level on R81.20, R82.00, and R82.10. The second is the classic Jumbo Hotfix: install the latest version for your branch.

The customer feedback in the thread is less smooth than the official messaging. Several accounts report the automatic rollout had not reached them on announcement day, with boxes still on Take 17 or Take 18 of the urgent security update. Others say the download links in the two advisories did not work, while the Live Patch article link did. The fix exists; its distribution is still in flight.

To check a box’s exact level, the standard command remains:

# show the version and the Jumbo Hotfix Take level
show version all

The Take shown must be above the vulnerable thresholds (43 for R82.10, 125 for R82, 165 for R81.20). A box below a Take level and not covered by the Live Patch stays exposed until the Jumbo Hotfix is installed.

What you should do now

The order of operations is dictated by the Dutch NCSC as much as by the vendor: treat the flaw before exploitation, not after.

• Enable or verify the Live Patch across your Quantum fleet: it is the fastest route, deployed without a service restart.
• Move up to the Jumbo Hotfix on the three affected branches — R82.10 (beyond Take 43), R82 (beyond 125), R81.20 (beyond 165) — without waiting for the Live Patch to reach you.
• Treat certificates as a surface: disabling the VPN blade does not protect a box that still carries VPN certificates; isolate boxes whose certificates are unused.
• Restrict access to the Security Management Server: it is the target of CVE-2026-85103, and was already the target in the June and July episodes. The management console must never be reachable from the internet.

The underlying lesson is the same as in June: a fix is only a closure if it is installed. CISA’s KEV has not yet ruled on these two identifiers, but the history of the past three months — two additions in two months — suggests it is only a matter of days if a campaign starts.

Verdict

CVE-2026-85102 and CVE-2026-85103 are not confirmed exploits: they are two CVSS 9.8 flaws patched before known exploitation, with a Dutch NCSC judging the test imminent. The fix exists and ships via Live Patch and Jumbo Hotfix alike.

If you operate Security Gateways or a Security Management Server, apply the Live Patch immediately, then plan the Jumbo Hotfix upgrade. If a box cannot be patched within the day, isolate it from the internet perimeter and remove unused VPN certificates — but treat that as a reprieve, not a defense. The real conclusion goes beyond the incident: a certificate surface that yields three times in four months demands a reset of how you supervise that component, not yet another emergency patch.

References

• Check Point — advisory for CVE-2026-85102 and CVE-2026-85103 (Security Gateway / Security Management Server), September 9, 2026
• BleepingComputer — Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent, September 12, 2026
• The Hacker News — Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE, September 10, 2026
• Canadian Centre for Cyber Security — Check Point advisory, September 9, 2026
• CISA — Known Exploited Vulnerabilities Catalog