Check Point Patches Two Critical VPN Certificate-Processing Vulnerabilities
Summary
Check Point disclosed and began patching two CVSS 9.8 flaws in VPN certificate processing affecting Quantum Security Gateway, Security Management Server, and Spark Firewall products. The flaws may allow code execution under specific conditions.
Key points
- CVE-2026-85102 is an improper certificate trust-validation flaw; an unauthenticated remote actor may execute code on an affected Security Gateway under specific conditions.
- CVE-2026-85103 is a heap-based buffer overflow in VPN certificate processing that may lead to code execution on affected Security Gateway and Security Management Server systems.
- Both vulnerabilities are reachable during certificate processing before VPN authentication is complete.
- Check Point said it discovered the flaws internally and began releasing fixes through Live Patch and updated Jumbo Hotfix packages on September 9, 2026.
- Organizations should review affected deployments and install the latest vendor updates or verify Live Patch protection is active.
- Until upgrades are complete, the article recommends restricting UDP ports 500 and 4500 to known VPN peers and monitoring VPN logs for unusual negotiation or certificate-processing activity.
Article Details
- Vulnerability Types
- Improper certificate trust validation during VPN negotiation
- Heap-based buffer overflow during ASN.1 VPN certificate processing
- Severity
- Critical (CVSS 9.8)
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Where upgrades are pending, limit UDP ports 500 and 4500 to known VPN peers.
- Disable unused VPN services and remove unnecessary internet exposure.
CVE
Vendors
Products
Jumbo HotfixCheck Point reported that it discovered the vulnerabilities internally and began releasing fixes through Live Patch and updated Jumbo Hotfix packages on September 9, 2026.Live PatchCheck Point reported that it discovered the vulnerabilities internally and began releasing fixes through Live Patch and updated Jumbo Hotfix packages on September 9, 2026.Quantum Security GatewayCheck Point recently disclosed and patched two critical vulnerabilities (CVSS: 9.8) affecting Quantum Security Gateway, Security Management Server, and Spark Firewall products.Security Management ServerCheck Point recently disclosed and patched two critical vulnerabilities (CVSS: 9.8) affecting Quantum Security Gateway, Security Management Server, and Spark Firewall products.Spark FirewallCheck Point recently disclosed and patched two critical vulnerabilities (CVSS: 9.8) affecting Quantum Security Gateway, Security Management Server, and Spark Firewall products.