Check Point twin CVSS 9.8s in VPN certificate path (CVE-2026-85102 / 85103)

Two CVSS 9.8 bugs in VPN certificate parsing

Check Point disclosed on September 9, 2026 two critical flaws in VPN certificate handling on Quantum Security Gateway and Security Management products (with Spark deployments called out in secondary advisories). CVE-2026-85102 is improper validation of certificate data during VPN negotiation. CVE-2026-85103 is a heap overflow in VPN certificate ASN.1 decoding. Both carry vendor-assigned CVSS 9.8 scores and can allow unauthenticated remote code execution “under specific conditions” Check Point has not fully detailed publicly. Vendor documents: sk1000117 and sk1000118.

There is no confirmed in-the-wild exploitation as of disclosure. Check Point says it found both issues internally and has not published IoCs because it has seen no evidence of external exploitation. R82.20 is not affected. Remediation on supported branches is LivePatch Take 24 (rollout began September 9) and/or the latest Jumbo Hotfix Accumulator for the deployed release. Public CVE text commonly marks R82.10 Jumbo Take 43 or below, R82 Take 125 or below, and R81.20 Take 165 or below as affected. End-of-support R80 through R81.10 need an upgrade to a fixed supported release.

The gateway parses this data before the peer is trusted

Both bugs sit in VPN negotiation, the code that has to parse certificate data from a peer before the session is trusted. That makes them remote, unauthenticated code execution on infrastructure, like this week’s firewall and ERP kernel stories. Exploitation isn’t confirmed. Check Point’s 2026 record on this product family is still a good reason to install LivePatch or the Jumbo this week. CVE-2026-85103 also reaches Security Management, so the exposure goes beyond the gateway dataplane.

Check versions, confirm LivePatch, limit IKE ports

• Confirm whether gateways and management are on R82.20 (unaffected) or need LivePatch Take 24 / latest Jumbo for R81.20, R82, or R82.10.
• Confirm LivePatch actually installed. An “auto” setting is not proof, so check inventory.
• For Site-to-Site estates that cannot patch today, tighten UDP/500 and UDP/4500 to known peers and review implied VPN rules, then schedule the Jumbo or LivePatch.
• Treat EoS R80–R81.10 as upgrade-urgent; do not expect LivePatch on abandoned branches.
• With no public IoCs yet, hunt unusual VPN negotiation crashes, unexpected code execution on gateway or management hosts, and certificate-processing anomalies around the disclosure window.

Sources

• Check Point SKs sk1000117 and sk1000118
• The Hacker News: Check Point twin CVSS 9.8 VPN certificate flaws

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].