Check Point Patches Two Critical Flaws in VPN Certificate Handling

Check Point has shipped fixes for two critical vulnerabilities in the way its firewalls and management products handle VPN certificates. Both holes were rated 9.8 on the CVSS scale and, according to the vendor, allow an unauthenticated remote attacker to execute arbitrary code — though only “under certain conditions,” which the company did not describe. Check Point assigned the identifiers and scores itself, saying it had found the problems on its own and had no data on any attacks.

The first vulnerability, CVE-2026-85102, involves improper certificate trust validation during VPN connection negotiation and affects security gateways. The second, CVE-2026-85103, is a heap-based buffer overflow in parsing the ASN.1 structure of a certificate; it reaches both the gateways and the Quantum Security Management server. Notably, according to a Check Point employee on the community forum, the second problem can in theory be triggered even where VPN is disabled but certificates are present — since it's precisely about certificate handling.

Gaps in the information

The advisory was published on September 9, and the fixes started rolling out the same day. But the picture turned out to be muddled. The CVE entries list three Quantum branches (R82.10, R82, R81.20) with specific Jumbo Hotfix levels, while a parallel advisory from the Canadian Centre for Cyber Security names a broader set of products, including the Spark line for small business — but with no versions at all. Neither document clarifies which builds contain the fix itself or what the “certain conditions” are.

The promised automatic Live Patch mechanism did not reach everyone: at least five customers reported that their gateways were still on outdated update packages. The download links in the advisories would not open for some users, even though a vendor employee insisted everything was working.

For those who can't update

Left out separately were those for whom no patch is available at all. Customers on the R81.10 branch discovered that there is neither a Jumbo Hotfix nor a Live Patch for it, and the only alternative is a workaround. Administrators called its wording (“disable implicit rules for VPN”) too vague to act on: exactly which configuration lines to comment out, and how to avoid cutting off remote users in the process — the discussion found no answer to these questions.

The context adds to the anxiety: over the summer Check Point had already twice closed critical holes in the same products, and those were being exploited even before the announcement and made it into CISA's catalog of actively exploited vulnerabilities. The company is not publishing indicators of compromise for the new vulnerabilities, explaining that such signs apply only to already-existing exploits. Whether an attacker who managed to break in before the patch was installed would retain access is also not stated in the materials.

Source: The Hacker News