Check Point has disclosed two critical vulnerabilities in the certificate-processing functionality of its firewall and management products that can potentially allow an unauthenticated remote attacker to execute arbitrary code. The vulnerabilities, tracked as CVE-2026-85102 and CVE-2026-85103, both carry CVSS scores of 9.8 and were disclosed on September 9, 2026. CVE-2026-85102 involves improper validation of certificate trust during VPN negotiation and can potentially lead to remote code execution on a Security Gateway. CVE-2026-85103 is a heap-based buffer overflow in the ASN.1 decoding path used to process VPN certificates and can potentially allow arbitrary code execution on both Security Gateways and Security Management Servers. Check Point says it identified the flaws internally and has not observed evidence that attackers are exploiting either vulnerability in the wild. 

The severity of the vulnerabilities comes partly from where the vulnerable functionality sits. VPN gateways deliberately accept complex, attacker-supplied data from untrusted networks because they need to negotiate connections before a user or peer has necessarily been authenticated. Certificate parsing is therefore part of the pre-authentication attack surface. If a vulnerability occurs while the gateway is deciding whether a certificate should be trusted, traditional authentication controls may never get the opportunity to protect the system. In the worst case, malicious certificate data can exploit the component responsible for validating the certificate before the certificate itself has been accepted.

CVE-2026-85102 demonstrates the logical side of that problem. Check Point describes it as a failure to properly validate certificate trust during VPN negotiation. An unauthenticated attacker may therefore be able to manipulate the certificate-processing workflow in a way that reaches code execution on the Security Gateway. The precise exploitation conditions have not been publicly documented, and Check Point has said only that exploitation is possible under specific conditions. That lack of detail is understandable while patches are being distributed, but it means administrators should not attempt to assess safety by guessing that their particular VPN configuration is unaffected.

CVE-2026-85103 presents a more traditional memory-corruption problem. Check Point says a heap overflow exists while decoding the ASN.1 structure of a VPN certificate. ASN.1 is widely used to encode certificates and other cryptographic objects, but its flexibility also means parsers have to handle deeply structured, attacker-controlled data safely. A malformed object that causes a length calculation, allocation or parsing error can potentially corrupt memory inside the privileged process processing the certificate. In this case, Check Point says successful exploitation may provide unauthenticated remote code execution on either the Security Gateway or the Security Management Server.

That management-server exposure is particularly significant. A compromised firewall gateway is already a severe event, but compromising the management server can potentially expose the broader firewall estate. The management platform contains policy definitions, network objects, managed-device relationships and administrative information. Depending on deployment and post-compromise capabilities, control of that platform could give an attacker insight into how the organization has segmented its network and which systems defenders consider important.

This is why firewall-management infrastructure should be treated as Tier-0 or equivalent administrative infrastructure. It is not simply another Linux server running an application. It defines security policy for other systems. If the management plane becomes untrusted, administrators have to consider not only whether the host itself was compromised but whether firewall rules, VPN configuration, objects or managed-device settings were changed while the attacker had access.

CVE-2026-85103 is also noteworthy because Check Point says the vulnerability may theoretically be reachable even where the VPN software blade is disabled if VPN certificates remain present in the environment. In response to a customer question, a Check Point representative explained that the issue concerns certificate processing and could therefore potentially be triggered without an actively configured VPN service under some conditions.

That is an important lesson for vulnerability assessment. Administrators often determine exposure by asking whether the affected feature is enabled. Normally that is sensible. But shared certificate-processing libraries may be invoked by several services or management functions. A vulnerable parser can therefore remain part of the reachable attack surface even when the most obvious associated feature appears disabled.

The affected release families are broad. The CVE records list R81.20, R82 and R82.10 branches, with affected builds including R82.10 Jumbo Hotfix Take 43 and earlier, R82 Take 125 and earlier, and R81.20 Take 165 and earlier. Check Point’s CVE-2026-85103 advisory additionally lists older end-of-support releases including R80 through R81.10, along with Spark releases R81.10.x and R82.00.x. R82.20 is explicitly listed as not affected by CVE-2026-85103.

For supported R81.20, R82 and R82.10 deployments, Check Point is distributing protection through its LivePatch mechanism. The vendor says customers that have enabled automatic LivePatch installation are protected as the rollout reaches their systems. The relevant urgent security update is Take 24, and Check Point provides commands such as `cpinfo -y CPupdates` and `cplp list` so administrators can verify that the protections for CVE-2026-85102 and CVE-2026-85103 are actually installed.

That verification step should not be treated as optional. Automatic updating is useful, but “automatic” does not mean “already installed everywhere.” Customers reported during the initial disclosure that some gateways had not yet received the latest automatic update. Administrators should therefore verify the installed LivePatch state directly rather than assuming protection simply because automatic updates are enabled.

Check Point has also incorporated the fixes into Jumbo Hotfix Accumulators. For CVE-2026-85103, the vendor lists R82.10 Jumbo Hotfix Take 44 or later, R82 Take 126 or later, and R81.20 Take 166 or later as containing the fix. Spark customers are directed to R82.00.10 Build 2325 or later and R81.10.17 Build 4968 or later.

This distinction between LivePatch and full Jumbo Hotfix deployment is useful operationally. Live patching provides organizations with a way to reduce exposure rapidly without immediately going through a larger software-upgrade cycle. That can be particularly valuable for perimeter devices where maintenance windows are difficult to schedule. However, administrators should still plan to incorporate the permanent fixed builds into their normal patch baseline rather than treating an emergency live patch as a reason never to update the underlying software.

Organizations unable to patch immediately have more limited options. For site-to-site VPN deployments, Check Point recommends disabling implied VPN rules and explicitly allowing UDP ports 500 and 4500 only from the IP addresses of legitimate VPN peers. This reduces the number of external systems capable of reaching the vulnerable negotiation path. The mitigation is not applicable to locally managed Spark firewalls.

This is a particularly useful example of why peer restriction should be used wherever site-to-site VPN topology allows it. If an organization knows that a VPN tunnel should originate only from a handful of static peer addresses, there is little security benefit in exposing IKE negotiation to the entire internet. Restricting source addresses does not fix the vulnerable parser, but it significantly reduces the population of systems capable of sending malicious input to it.

Remote-access VPN presents a more complicated problem because legitimate users may connect from unpredictable networks. In those environments, patch deployment becomes even more important because source-IP restriction may not be operationally practical.

The disclosure also follows several serious Check Point VPN and management vulnerabilities earlier in 2026. In June, CVE-2026-50751 was actively exploited to bypass authentication in Remote Access VPN deployments using legacy IKEv1 configurations. In July, Check Point patched CVE-2026-16232, an authentication-bypass vulnerability affecting SmartConsole and Security Management Server.

The recurrence should encourage organizations to review the exposure of the entire management and VPN plane rather than treating each CVE as an isolated event. Management interfaces should not be broadly reachable from user networks or the public internet. Administrative access should originate from dedicated management networks or hardened jump hosts, while VPN-related ports should be exposed only where required.

The June exploitation of CVE-2026-50751 also provides useful context for the new flaws. That earlier vulnerability involved certificate validation during IKEv1 negotiation and allowed an attacker to establish a VPN session without a valid user password under specific configurations. Check Point observed exploitation against several dozen organizations and linked at least one post-exploitation case to a Qilin ransomware affiliate.

There is currently no evidence that CVE-2026-85102 or CVE-2026-85103 are being exploited in the same way. That distinction should remain explicit in public reporting. But the history shows that VPN certificate-processing weaknesses are attractive enough to attackers that organizations should not wait for KEV inclusion or public exploit code before deploying available fixes.

Network security devices occupy a particularly dangerous position when compromised because traditional endpoint telemetry may be limited. Organizations generally deploy EDR extensively across Windows and Linux servers but cannot install conventional endpoint agents inside proprietary firewall appliances. That makes centralized logging, management auditing and network telemetry essential.

Security Gateway and Security Management logs should therefore be exported to independent logging infrastructure. If a future exploit provides root access, local logs on the compromised appliance may no longer be completely trustworthy. Authentication activity, policy changes, administrative actions and unexpected process events should be retained somewhere the compromised gateway cannot modify.

Configuration integrity should also be monitored. Organizations should keep known-good copies of gateway and management configuration and compare them following suspicious activity. Attackers who gain privileged access to a firewall may not need to install persistent malware if they can simply modify one rule, create a new VPN path or weaken a security policy.

Outbound connectivity from management and firewall appliances should likewise be constrained. A gateway needs to communicate with defined update, management, DNS and logging infrastructure, but it rarely needs unrestricted outbound internet access. Unexpected connections from the management plane to new external destinations can provide a useful post-exploitation indicator.

The two vulnerabilities also demonstrate why certificate handling should be viewed as hostile-input processing. Certificates are often mentally associated with trust, encryption and authentication, so it is easy to think of them as intrinsically safe objects.

They are not.

Before a certificate can establish trust, software has to parse it.

And until that parsing is complete, the certificate is simply attacker-controlled structured data arriving from the network.

CVE-2026-85103 shows exactly why that distinction matters. A certificate may eventually be rejected as invalid, but if its ASN.1 structure corrupts memory while being decoded, the rejection happens far too late.

This is a broader secure-development lesson for every VPN, TLS and PKI implementation. Certificate parsers should be designed under the assumption that every byte is malicious until proven otherwise. Length fields, nested structures, extensions and encoding variations need strict validation before privileged code trusts them.

The flaws also demonstrate the difference between cryptographic security and implementation security. An organization can use strong encryption algorithms, properly issued certificates and secure VPN protocols while still being vulnerable because the code handling those certificates contains a memory corruption or trust-validation error.

Strong cryptography cannot compensate for unsafe parsing.

For defenders, the response should therefore be straightforward: verify exposure, confirm LivePatch or fixed Jumbo Hotfix installation, restrict VPN peer access where practical, protect management interfaces and retain external telemetry.

Because Check Point currently reports no exploitation, a full incident-response operation is not automatically required solely because a system was vulnerable. However, if administrators observe unexplained crashes, unusual administrative activity, unexpected configuration changes or suspicious outbound connections during the exposure period, compromise investigation would be warranted.

The broader lesson from CVE-2026-85102 and CVE-2026-85103 is that the VPN gateway is itself part of the attack surface before authentication ever succeeds. The gateway has to listen. It has to parse. It has to decide whether the remote certificate should be trusted. And all of that happens while the remote party is still untrusted. 

If an attacker can compromise the code performing those decisions, then the security boundary can fail before the authentication mechanism even gets a vote. That is why these vulnerabilities deserve urgent remediation despite the current absence of observed exploitation. The firewall may be protecting the network. But the first thing protecting the firewall is the code parsing whatever the internet sends it.

Check Point has patched two critical vulnerabilities in the way its firewall and management products handle VPN certificates. The company says both could allow an unauthenticated remote attacker to run code, but only "under specific conditions" that it has not described. One flaw affects Check Point's Security Gateways, its firewall appliances. The other affects those gateways and the Security

Source: Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE via The Hacker News — published 10 Sep 2026.