Check Point patches two critical VPN gateway bugs

Check Point on Sept. 9 released patches for two 9.8 CVSS bugs in its VPN gateways, a sign that security teams must continue to guard against attacks on critical network infrastructure.

The good news here: there’s no sign as of yet that the two flaws — CVE-2026-85102 and CVE-2026-85103 — were exploited in the wild.

According to Check Point, CVE-2026-85102 was an improper certificate trust validation during VPN negotiation, while CVE-2026-85103 was a heap overflow in the VPN certificate ASN.1 decoding flow.

Denis Calderone, chief technology officer at Suzu Labs, said the network perimeter has come under more pressure today than at any point in his career. Calderone pointed out that both bugs are exploitable without any authentication, and they affect Security Gateway, Spark Firewall, and in the case of the heap overflow, the Security Management Server itself.

“Check Point found them internally and says no exploitation has been observed yet, but that qualifier has had a shorter and shorter shelf life in 2026,” said Calderone. “The window between public disclosure and active exploit campaigns has compressed to the point where ‘we patched within 48 hours’ may not be fast enough. We've seen it this year with Palo Alto GlobalProtect, SonicWall SMA1000, wp2shell in WordPress, and Check Point's own CVE-2026-50751 back in June. The pattern is consistent and accelerating.”

Shane Barney, chief information security officer at Keeper Security, explained that VPN gateways are a direct entry point to the network perimeter, making them a prime target for attackers. When a VPN gateway gets compromised, Barney said attackers land on the network perimeter, and from there they can move toward the identity layer: CVE-2026-85102 and CVE-2026-85103 exemplify this as unauthenticated remote code execution flaws that let attackers breach the gateway without any credentials at all.

“The fact that these vulnerabilities haven't been exploited yet doesn't reduce the urgency to address them,” said Barney. “Attackers continuously probe critical infrastructure, find weaknesses and persist inside networks until they're ready to move. A CVSS 9.8 vulnerability with no authentication requirement is a serious exposure that security teams should prioritize locking down.”

Roman Sannikov, global research coordinator at iCounter, said that the fact that Check Point found these internally and said there's no evidence of exploitation is the best news in this story, and also the part of the window that's closing the fastest.

“Once a patch ships, the patch itself is the blueprint,” said Sannikov. “Anyone who wants to know exactly what changed just needs to diff the old binary against the new one, and that kind of analysis, figuring out precisely where the certificate validation broke and how to build a working heap overflow trigger from it, is exactly the work AI tools are getting faster at every month.”

Sannikov added that not being in CISA's Known Exploited Vulnerabilities (KEV) catalog yet doesn't make this less important: the clock that actually matters here, patch to public exploit, hasn't run out yet. Sannikov said VPN gateways are also a specific kind of target worth treating differently than a random internal server: they sit on the internet by design, they're the device organizations put there specifically to be reachable, and an unauthenticated RCE at that layer skips past almost every other control an organization has, no phishing required, no credential needed, just a crafted certificate during negotiation.

“It's also worth remembering what a VPN actually is to an organization,” said Sannikov. “It's usually the first line of defense, the single gate the entire workforce goes through to reach internal systems, not just one team's tool. A compromise here doesn't touch one department, it touches whoever depends on that gateway to get to work, which at most organizations is everyone.

Sannikov said security teams waiting for a KEV listing or a confirmed in-the-wild exploit before treating this as urgent are optimizing for the wrong signal: the right signal here is unauthenticated, RCE, and internet-facing.

"That combination should be enough on its own to move this to the top of the patch queue this week, not after someone else gets hit first," said Sannikov.