Check Point VPN Has Two 9.8 RCEs. The Certificate Parser Is the Attack Surface

• The Mess: Check Point patched two CVSS 9.8 vulnerabilities in VPN certificate processing that can let an unauthenticated remote attacker reach code execution.
• The Damage: A compromised gateway sits at the network perimeter and can become the attacker’s first foothold inside the organization.
• The Fix: Patch the affected Quantum branches immediately and restrict VPN access while checking whether vulnerable certificate-processing paths are exposed.

A firewall is supposed to be the thing standing between the Internet and your network.

That makes a remote code execution bug inside the firewall particularly unpleasant.

Check Point disclosed two critical vulnerabilities on September 9: CVE-2026-85102 and CVE-2026-85103. Both carry a CVSS 9.8 rating and can be reached remotely without authentication under the conditions described by Check Point.

The two bugs live in the same general area: VPN certificate processing.

One is an authentication/certificate-validation problem.

The other is a memory-corruption bug.

Together they show why parsing security-sensitive data on an Internet-facing gateway is such a dangerous job.

Two Bugs, Two Different Failure Modes

CVE-2026-85102 is an improper certificate-trust validation flaw during VPN negotiation.

The CVE description says an unauthenticated remote attacker may be able to execute arbitrary code on a Check Point Quantum Security Gateway. The published CVSS vector gives it network reachability, low attack complexity and no privileges or user interaction.

CVE-2026-85103 takes a more traditional memory-corruption route.

It is a heap-based buffer overflow in the ASN.1 decoding flow for VPN certificates. The vulnerable parser processes certificate structures before the attacker has authenticated. Successful exploitation can therefore reach arbitrary code execution on affected Check Point systems.

ASN.1 is not some obscure VPN-specific format.

It is used throughout certificate infrastructure.

That makes the parser a particularly interesting target: a remote certificate can carry a complicated nested structure that must be decoded before the system can decide whether the certificate should be trusted.

The Attack Path

The conceptual attack chain looks like this:

Internet
   ↓
VPN negotiation
   ↓
Attacker-controlled certificate data
   ↓
Certificate validation / ASN.1 parsing
   ↓
CVE-2026-85102 or CVE-2026-85103
   ↓
Code execution
   ↓
Security Gateway / Management Server
   ↓
Network access and lateral movement

The attacker does not start with a valid VPN account.

That is the important part.

The vulnerable processing happens around the machinery that decides whether a VPN connection is legitimate in the first place.

For CVE-2026-85103, the heap overflow gives the attacker a memory-corruption primitive inside the certificate decoder. For CVE-2026-85102, the failure is in certificate trust validation.

Check Point has not publicly released a weaponized exploit or described the exact conditions required to turn either vulnerability into reliable RCE. So we should not pretend there is a simple public one-line exploit.

The risk is nevertheless clear.

The parser is reachable before authentication.

Which Check Point Systems Are Affected?

The published affected builds include:

• R82.10 — Jumbo Hotfix Take 43 or earlier
• R82 — Jumbo Hotfix Take 125 or earlier
• R81.20 — Jumbo Hotfix Take 165 or earlier

CVE-2026-85102 specifically affects Security Gateway deployments using Site-to-Site VPN or Remote Access VPN.

CVE-2026-85103 affects Security Management Server, Security Gateway and Spark Firewall according to Check Point’s advisory information.

Check Point is distributing fixes through LivePatch and the appropriate Jumbo Hotfix releases.

Are You Vulnerable?

Do not start by scanning the Internet for the vulnerable endpoint.

Start locally.

On a Check Point gateway, determine the installed version and Jumbo Hotfix level. The target is to establish whether you are at or below one of the vulnerable build thresholds.

For the affected Quantum branches, anything at or below the listed Take level should be treated as vulnerable until the vendor update has been applied.

The important distinction is:

having the VPN blade enabled is not the only thing to consider.

Check Point’s own discussion around the issue indicates that certificate processing is the underlying security boundary, and one staff response noted that CVE-2026-85103 could theoretically matter even where VPN is not actively running if VPN certificates are present.

So don’t use:

“We don’t currently have remote users.”

as your vulnerability test.

Use the actual software build.

Can You Detect Exploitation?

This is where the situation gets annoying.

Check Point says it has no evidence that these vulnerabilities have been exploited and has not published useful exploitation indicators for the two CVEs.

That means defenders should not expect a neat IOC such as:

malicious_file.exe
known_IP
known_hash

Instead, investigate the surrounding VPN and gateway telemetry.

Look for:

• unexpected VPN negotiation failures;
• bursts of malformed or unusual certificate exchanges;
• repeated connection attempts from previously unseen Internet addresses;
• unexplained gateway process crashes or restarts;
• unusual administrative logins immediately after VPN anomalies;
• new configuration changes;
• unexpected outbound connections from the gateway;
• unexplained changes to VPN peers or certificates.

A crash immediately followed by successful administrative activity deserves attention.

So does a gateway that suddenly begins communicating with infrastructure it has never contacted before.

The Safer Mitigation

Patch.

If immediate patching is impossible, Check Point recommends reducing exposure by manually defining VPN rules.

For Site-to-Site VPN, its guidance recommends disabling implied VPN rules and explicitly defining access for UDP/500 and UDP/4500 only for the required peer IP addresses.

That is much better than leaving VPN negotiation broadly reachable.

But it is a mitigation, not a substitute for the security update.

And there is an important operational problem: some older branches do not have the same patch availability as the supported R81.20/R82/R82.10 branches. Organizations stuck on older releases should treat migration as part of the remediation rather than assuming the gateway is permanently protected by configuration alone.

If You Were Exposed

If a vulnerable Check Point gateway has been Internet-facing, patching is only step one.

Review:

1. VPN authentication and negotiation logs.
2. Administrative login history.
3. Configuration changes.
4. Newly created accounts.
5. Certificate changes.
6. Unexpected outbound connections.
7. Gateway crashes or abnormal restarts.
8. Traffic from the gateway into sensitive internal segments.

Then rotate credentials associated with systems that could have been reached from the gateway if you find suspicious activity.

The reason is simple: a perimeter appliance is rarely an isolated computer.

It can see the network.

It can authenticate users.

It can control traffic.

And it often has privileged relationships with the rest of the infrastructure.

Why Certificate Parsers Keep Getting Interesting

Certificate processing looks harmless because certificates are supposed to be trusted objects.

The parser sees something that eventually becomes:

“This connection is legitimate.”

But before that decision exists, the software has to parse bytes supplied through a network protocol.

That creates a classic security problem:

Untrusted bytes
       ↓
Complex parser
       ↓
Security decision

If the parser crashes, corrupts memory or incorrectly validates the certificate, the security decision may never become relevant.

The attacker has already reached the vulnerable code.

That is precisely why CVE-2026-85102 and CVE-2026-85103 deserve more attention than their generic “VPN vulnerability” labels suggest.

Bugstoday Opinion

The most dangerous device on a network is sometimes the one everyone assumes is protecting it.

Check Point’s new bugs are a good example.

The attacker does not need to steal a VPN password first. The attack surface begins while the gateway is still deciding whether the connection should be trusted.

One vulnerability corrupts the certificate trust logic.

The other corrupts memory in the certificate decoder.

Both sit before authentication.

That is a terrible place to have a 9.8.

Today’s Bugs. Tomorrow’s Breaches.

Technical Sources

Check Point Security Advisory SK1000117 — CVE-2026-85102

Check Point Security Advisory SK1000118 — CVE-2026-85103

Check Point CheckMates — Critical VPN Security Advisory

CERT-EU — Critical Vulnerabilities in Check Point Products

SecurityWeek — Check Point Patches Critical VPN Vulnerabilities

CVE-2026-85102

CVE-2026-85103