Check Point Patches Critical VPN Vulnerabilities

1. Executive summary

On 11 September 2026, Check Point released patches for two critical (CVSS 9.8) vulnerabilities — CVE-2026-85102 (CWE-295, improper certificate validation) and CVE-2026-85103 (CWE-122, heap-based buffer overflow) — in its Security Gateway, Spark Firewall and Security Management Server products. Both are unauthenticated, remotely exploitable RCE flaws in the VPN certificate handling path, affecting Site-to-Site VPN and Remote Access VPN deployments. Neither CVE is in the CISA KEV catalogue and both carry an EPSS score of 0%; Check Point states it found both internally and has no evidence of in-the-wild exploitation. EMEA financial services running Check Point perimeter VPNs should treat this as a high-priority patch cycle: internet-exposed VPN termination is a proven initial-access vector against this vendor's product line this year (CVE-2026-50751, exploited since May 2026 by a ransomware affiliate), and the affected components are the same class of certificate-validation code.

2. Regulatory framing

No NIS2 or UK NIS article is directly engaged by this item: there is no incident, no exploitation evidence, and no reportable event — only a vendor patch cycle. If exploitation of these CVEs is later observed in a client environment, DORA Art. 18 (classification) and Art. 19 (reporting of major ICT-related incidents) would become relevant at that point.

3. Technical analysis & attack chain

Vulnerability detail (from vendor disclosure via SecurityWeek and The Hacker News)

1. CVE-2026-85102 — CVSS 9.8 CRITICAL, CWE-295 (Improper Certificate Validation), not in CISA KEV, EPSS 0%. Improper validation of certificate data during VPN negotiation. Affects Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN. Exploitable without authentication for remote code execution, per Check Point, "under specific conditions" the vendor has not publicly described (The Hacker News).
2. CVE-2026-85103 — CVSS 9.8 CRITICAL, CWE-122 (Heap-based Buffer Overflow), not in CISA KEV, EPSS 0%. Heap overflow in the VPN certificate ASN.1 decoding flow. Affects Check Point Security Management Server, Security Gateway, and Spark Firewall. Also unauthenticated RCE.

Attack chain (reconstructed, NOT observed): Both flaws sit in the pre-authentication VPN certificate parsing path. A plausible chain is: attacker reaches the gateway's VPN listener (UDP/500, UDP/4500 for IKE/IPsec per the vendor's own mitigation guidance) → sends a crafted certificate / ASN.1 structure during VPN negotiation → either bypasses validation logic (85102) or overflows the heap in the decoder (85103) → achieves code execution in the gateway/management process context. Check Point has not disclosed the exact conditions, the affected process, or post-exploitation behaviour, and there is no evidence of exploitation in the wild for either CVE — this chain is an inference from the vulnerability class and vendor description, not from incident data.

Context — why this vendor's VPN stack is a live target: In June 2026, Check Point disclosed that CVE-2026-50751 (CVSS 9.3), a logic-flow weakness in Remote Access/Mobile Access certificate validation, had been exploited since 7 May 2026, enabling unauthenticated attackers to bypass authentication and establish a VPN session without a password on IKEv1-configured deployments; Check Point observed post-compromise activity from a Qilin ransomware affiliate in at least one case, and its VP of research assessed the same affiliate is likely exploiting VPN flaws in Palo Alto Networks, Fortinet and F5 products (The Register). A companion flaw, CVE-2026-50752 (IKEv1 certificate validation, MITM on site-to-site VPN), was patched with no observed exploitation. ANSSI/CERT-FR separately flagged active exploitation of CVE-2026-50751. The June flaws and today's CVEs affect the same product family and the same certificate-validation code area — the June campaign demonstrates both a working exploitation playbook against this stack and ransomware interest in it.

Confidence caveats: The Qilin attribution and the multi-vendor affiliate claim are single-sourced (Check Point's own research, relayed via The Register) — verify before treating as established. The "specific conditions" gating exploitation of CVE-2026-85102/85103 are undisclosed; do not assume the flaws are trivially exploitable at scale. No MITRE ATT&CK profile exists for the actor in the verified reference data, so the ransomware-affiliate attribution should be treated as unconfirmed.

4. Mitigation & containment

P1 — within 24 hours

• Inventory and exposure check: Identify all Check Point Security Gateways, Spark Firewalls and Security Management Servers on versions R82.10, R82, R81.20. Confirm which run Site-to-Site VPN or Remote Access VPN and which SmartConsole/management servers are reachable from untrusted networks.
• Apply the vendor security updates released for R82.10, R82 and R81.20. Where Check Point LivePatch is enabled, confirm the patches landed automatically rather than assuming.
• Locally managed Spark Firewall instances: the vendor's rule-based mitigation does NOT apply to these — apply the latest Jumbo hotfix immediately.

P2 — within 72 hours

• Interim mitigation where patching is delayed (centrally managed gateways only): disable implied rules for VPN and manually define VPN access, restricting UDP/500 and UDP/4500 to specific peer IP addresses. Test site-to-site connectivity after the change — this is a breaking change to implied-rule deployments.
• Restrict management access to Security Management Server (affected by CVE-2026-85103) to trusted admin networks/VPN only.
• Review VPN certificate authentication logs back to at least 7 May 2026 — the window Check Point gave for the June zero-day campaign — for anomalous certificate subjects or authentication attempts from unexpected source IPs.

P3 — within 7 days

• Verify patch deployment across all estate, including HA clusters and standby members.
• Confirm IKEv1 is not in use anywhere remaining (deprecated protocol; it was the precondition for the June CVE-2026-50751/50752 exploitation) and migrate any residual IKEv1 site-to-site tunnels to IKEv2.
• Update third-party risk records for Check Point under DORA Art. 28 to reflect this patch cycle and the June exploitation history.

5. Indicators of compromise

No indicators of compromise available in the source material for CVE-2026-85102 or CVE-2026-85103 (no exploitation observed; no IOC list published for these CVEs in the provided sources).

Note: Check Point published an IOC list (attacker IPs, certificate subject names) for the June 2026 CVE-2026-50751 campaign, but the specific values are not reproduced in the provided source material and are therefore not listed here. Clients should pull the current IOC set from Check Point's security advisories and hunt SmartConsole VPN certificate authentication logs for the period 7 May – 5 June 2026 as described in The Register's coverage.

6. Detection

Insufficient indicators to author detection rules.

The provided sources contain no atomic artefacts (hashes, IPs, certificate subject strings, log signatures) for either the new CVEs or the June campaign that could form the strings section of a usable YARA or Sigma rule. Behavioural monitoring recommendation pending artefacts: alert on VPN certificate authentication attempts from source IPs outside expected peer geographies, and on any IKE negotiation traffic (UDP/500, UDP/4500) reaching gateways from addresses not in the manually defined peer allow-list once the P2 mitigation is applied.

CVE assessment

2 referenced CVEs — 2 critical (CVSS ≥ 9.0)

7. Sources

• SecurityWeek — Check Point Patches Critical VPN Vulnerabilities — https://www.securityweek.com/check-point-patches-critical-vpn-vulnerabilities/ — 2026-09-11
• The Hacker News — Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE — https://thehackernews.com/2026/09/check-point-discloses-two-98-rated-vpn.html — September 2026
• The Register — Ransomware crims got a month-long head start on Check Point VPN 0-day that now has a fix — https://www.theregister.com/cyber-crime/2026/06/08/attackers-had-month-long-head-start-on-patched-check-point-vpn-zero-day/5252438 — 2026-06-08
• The Hacker News — Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups — https://thehackernews.com/2026/06/critical-check-point-vpn-flaw-exploited.html — June 2026
• ANSSI France CERT (CERT-FR) — Multiples vulnérabilités dans les VPN Check Point — https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0711/ — 2026-06-09
• Cybersecurity Dive — Check Point warns of zero-day flaw targeted by ransomware affiliate — https://www.cybersecuritydive.com/news/check-point-zero-day-ransomware/822372/ — June 2026

8. Adverse Trace position

Both CVEs are correctly rated CRITICAL at CVSS 9.8 per the verified reference data, but the exploitation picture is materially better than the score alone suggests: neither CVE is in the CISA KEV catalogue, both sit at EPSS 0%, Check Point found them internally, and the vendor reports no evidence of in-the-wild exploitation. We assess the real-world risk as high but pre-exploitation — the June 2026 CVE-2026-50751 campaign proved that this vendor's VPN certificate-validation code is a viable ransomware initial-access target, and both new flaws sit in the same code area with unauthenticated RCE potential on internet-facing gateways. Clients should patch R82.10/R82/R81.20 within the P1 window rather than waiting for KEV listing, prioritising internet-exposed Remote Access VPN termination and any locally managed Spark appliances, which cannot use the interim mitigation. The Qilin affiliate attribution remains single-sourced and unconfirmed. Adverse Trace will monitor for KEV addition, EPSS movement, proof-of-concept publication, and any Check Point IOC release tied to these CVEs, and will reissue this advisory if exploitation is observed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.