What happened
Two certificate-processing flaws reach the network edge
Check Point released protections for two critical vulnerabilities that could allow an unauthenticated remote attacker to execute arbitrary code under specific conditions. Both issues were found internally, and the company said it had no indication of active exploitation at disclosure.
| Vulnerability | Issue | Potential impact |
|---|---|---|
| CVE-2026-85102 | Improper validation of certificate data during VPN negotiation | Unauthenticated remote code execution on affected gateways |
| CVE-2026-85103 | Heap overflow during ASN.1 decoding of VPN certificate data | Unauthenticated remote code execution affecting gateway and management components in the documented scope |
Defender priority
Why it matters
A security gateway is a high-trust target
VPN gateways and firewall-management systems sit where external access meets internal trust. Successful code execution could give an attacker a platform for persistence, credential or configuration theft, traffic manipulation, and further movement into the protected environment.
Security appliances can also hold topology, policy, certificate, and logging information. Compromise may therefore affect both the environment and the evidence defenders rely on to understand it.
Threat Field Notes assessment
Exposure
Do not assume a disabled feature means no risk
CVE-2026-85102 is associated with affected gateways configured for Remote Access VPN or site-to-site VPN. Check Point describes CVE-2026-85103 as a certificate-decoding issue whose affected scope can include Quantum Security Management and Quantum Security Gateway systems.
Because the second flaw concerns certificate processing, administrators should follow the vendor's exact affected-product logic rather than relying on the visible state of a VPN blade or on a general version list.
- Record the exact product, release, role, cluster membership, and VPN configuration.
- Check internet and partner reachability, including NAT and cloud security-group paths.
- Include standby and disaster-recovery appliances in the inventory.
- Identify unsupported releases and create an upgrade plan, not only an emergency-patch task.
Response
Patch, verify, and review the exposure window
- 1
Inventory. Identify every potentially affected gateway, management server, Spark appliance, and cluster member.
- 2
Confirm vendor guidance. Use the current Check Point advisories to determine affected versions, available LivePatch coverage, Jumbo Hotfix requirements, and any applicable mitigation.
- 3
Deploy protection. Apply the supported update through normal or emergency change procedures, with testing and rollback planning appropriate to the environment.
- 4
Verify every member. Confirm the protection is active on each appliance. Do not assume a staged or automatic rollout reached the entire estate.
- 5
Hunt around exposed systems. Review certificate-processing errors, unusual restarts, administrative activity, policy changes, unfamiliar VPN negotiations, and suspicious outbound connections.
- 6
Prepare incident actions. If compromise evidence appears, preserve logs and consider certificate revocation, credential rotation, trusted-state recovery, and examination of connected systems.
Takeaway
Treat the update as a race, not a routine cycle
Public patches give defenders a fix and attackers material to compare. Internet-facing VPN infrastructure deserves accelerated treatment even when exploitation has not yet been observed.
The immediate objective is simple: establish scope, apply the correct protection, verify it on every device, and investigate systems that were exposed while vulnerable.