Check Point released emergency patches on September 9 for two critical vulnerabilities in its Quantum Security Gateways and firewall product line. CVE-2026-85102 and CVE-2026-85103 both carry a CVSS score of 9.8 and allow unauthenticated remote code execution.
Check Point says both flaws were found internally and it has no evidence of exploitation in the wild. That has not stopped national cybersecurity agencies from pushing organizations to patch immediately, given how edge devices have fared this year. Palo Alto’s GlobalProtect and SonicWall’s SMA1000 both went from disclosure to active exploitation in a matter of weeks.
How the vulnerabilities work
Both flaws sit in the pre-authentication phase of VPN negotiation. An attacker doesn’t need valid credentials or a foothold inside the network to trigger either one.
CVE-2026-85102: certificate trust validation
CVE-2026-85102 is a logic flaw in the cryptographic handshake that sets up a VPN tunnel. When a client or peer gateway starts a site-to-site or remote access VPN connection, the two sides authenticate each other using digital certificates. A gateway is supposed to validate the certificate’s trust chain, expiration, and structural integrity before it proceeds.
Check Point’s gateway doesn’t do that validation properly. An unauthenticated attacker can present a malformed or forged certificate, and the gateway accepts it anyway, potentially letting the attacker run arbitrary code on the Security Gateway or Spark Firewall.
CVE-2026-85103: an ASN.1 heap overflow
CVE-2026-85103 is a heap-based buffer overflow that occurs while the gateway decodes the ASN.1 structure of a VPN certificate. ASN.1 is the encoding standard behind X.509 certificates, and parsing it has a long history of producing memory corruption bugs.
When the gateway allocates memory to decode an incoming certificate’s ASN.1 structure, a certificate with oversized or malformed length fields can make the decoder write past the end of that allocation. The overflow corrupts adjacent memory, including function pointers or heap metadata, which an attacker can use to hijack the process and achieve remote code execution. This flaw also affects the Check Point Security Management Server, not just the gateway and Spark Firewall.
Why VPN gateways keep getting targeted
VPN gateways sit on the network perimeter by design, reachable from the public internet, which makes them a different kind of target than an internal application server behind several layers of segmentation.
Shane Barney, CISO at Keeper Security, said VPN gateways are a direct entry point to the network perimeter, which is exactly why attackers go after them. Once someone compromises a gateway through an unauthenticated RCE bug like these, they’re already inside the perimeter and can pivot toward the identity layer, harvest credentials, and move laterally, all without phishing anyone.
Roman Sannikov, global research coordinator at iCounter, made a similar point: a breach at this layer bypasses almost every other control an organization has in place. No phishing email, no stolen credential. Just a crafted certificate sent over UDP port 500 or 4500.
📬 Stay Ahead of Cyber Threats
Get the latest cybersecurity news, critical vulnerabilities, threat intelligence, tutorials, and exclusive giveaways delivered straight to your inbox. No spam. Unsubscribe anytime.
Subscribe to the Newsletter →The exploit window keeps shrinking
Security teams have historically counted on some buffer between a patch shipping and an exploit showing up. That buffer is disappearing.
Denis Calderone, CTO at Suzu Labs, said the perimeter is under more pressure now than at any point in his career, and that the gap between disclosure and active exploitation has compressed sharply this year. “We’ve seen it this year with Palo Alto GlobalProtect, SonicWall SMA1000, wp2shell in WordPress, and Check Point’s own CVE-2026-50751 back in June,” Calderone said. “The pattern is consistent and accelerating.”
Part of that is AI-assisted reverse engineering. Sannikov said that once a patch ships, it becomes a blueprint: attackers diff the vulnerable binary against the patched one to see exactly where certificate validation broke or how the overflow was fixed. AI tools have gotten fast enough at analyzing those diffs that a working exploit can follow within days, sometimes hours.
Don’t wait for CISA’s KEV list
The Dutch National Cyber Security Centre rated the likelihood of exploitation and potential impact as high. CERT-EU issued an emergency advisory telling organizations to deploy the hotfixes immediately, with internet-facing appliances first.
Some teams still wait for a CVE to land on CISA’s Known Exploited Vulnerabilities catalog before prioritizing it. Sannikov argues that’s the wrong signal to wait for here. Both CVEs are unauthenticated, allow RCE, and sit on internet-facing infrastructure. That combination alone should put them at the top of the patch queue, regardless of whether exploitation has been confirmed yet.
Patching and mitigation
Check Point has shipped fixes for R81.20, R82, and R82.10 across the affected product lines. Most enterprise deployments should apply the latest Jumbo Hotfixes; organizations on Check Point’s LivePatch feature will get the update automatically.
Locally managed Spark Firewall instances are the exception. The network-level workaround described below does not apply to them, so those environments need the Jumbo Hotfix applied directly.
For gateways that can’t be patched or rebooted right away, Check Point’s workaround is to disable the default implied VPN rules and manually restrict UDP ports 500 (IKE) and 4500 (NAT-Traversal) to known, legitimate VPN peer IPs, dropping everything else.
That workaround cuts down on opportunistic scanning but doesn’t fix the underlying code. If an allowed peer’s IP is compromised or an attacker manages to spoof it, the gateway is still exploitable. Treat it as a stopgap until the hotfix is applied.
Takeaways for security teams
Edge devices and VPN gateways aren’t getting less important as hybrid work continues, which means they’ll keep drawing attention from attackers. Continuous monitoring of edge device telemetry, Zero Trust enforcement even on authenticated VPN sessions, and a patch process that prioritizes internet-facing RCE bugs are the baseline here, not extras.
CVE-2026-85102 and CVE-2026-85103 check every box that should move a patch to the front of the queue: unauthenticated, remote code execution, internet-facing. Organizations running affected Check Point products should apply the hotfixes now rather than wait for confirmation that exploitation has started.
