Check Point VPN: two CVSS 9.8 flaws, patch before the PoC

If your office firewall says Check Point on the front, go check its version before you read the rest of this. CVE-2026-85102 and CVE-2026-85103 are both CVSS 9.8, both unauthenticated remote code execution, and both live in the VPN certificate path — the code that runs before anyone logs in. Check Point shipped fixes on September 9. On September 12 the Dutch national cyber agency told everyone to stop waiting.

What actually happened

Check Point found both bugs internally and patched them on September 9 under advisories sk1000117 and sk1000118, per SecurityWeek.

CVE-2026-85102 is improper validation of certificate data during VPN negotiation. It hits Security Gateway and Check Point Spark Firewall running Site-to-Site VPN or Remote Access VPN. CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoding flow, and its blast radius is wider — Security Management Server, Security Gateway and Spark Firewall. Fixes landed in the R82.10, R82 and R81.20 trains.

Then the escalation. The Nationaal Cyber Security Centrum published an advisory rating both the likelihood of exploitation and the impact as high, and said it expects exploitation attempts soon. No public proof-of-concept has surfaced yet and Check Point reports no evidence of in-the-wild abuse. That is the window, not the all-clear — patched edge appliances get diffed, and a pre-auth RCE in certificate parsing is exactly the class of bug that gets reverse-engineered into a working exploit within days.

Check Point's interim mitigation for Site-to-Site VPN: disable implied rules for VPN and manually define access on UDP/500 and UDP/4500 to the specific peer IPs. LivePatch customers get the fix automatically. Locally managed Spark boxes need the latest Jumbo hotfixes applied by hand.

Why this matters for your business

Note which product is on both lists. Spark is Check Point's small-business firewall line — the appliance in the closet at a 15-person shop, bought once, mounted, and never thought about again. This is not an enterprise-only patch cycle. It is aimed directly at the boxes nobody owns.

An edge VPN appliance is the worst possible place for a pre-auth bug. It is internet-facing by definition, it sits inside your perimeter by design, and the vulnerable code path runs before any credential check — so MFA, strong passwords and a tight user list buy you exactly nothing here. Compromise the gateway and the attacker is on your LAN with the device's own trust.

Three moves, in order. Patch or hotfix this week, not at the next maintenance window; if LivePatch is available to you, confirm it actually applied rather than assuming. If you cannot patch immediately, apply the UDP/500 and UDP/4500 peer restriction — it narrows who can even reach the vulnerable negotiation. Then find out who owns the box. Most small companies discover during an incident that the answer was a contractor who stopped invoicing in 2023.

Sources: SecurityWeek, BleepingComputer.