Inside the Check Point VPN certificate flaws: what makes CVE-2026-85102 and CVE-2026-85103 exploitable

On September 16, 2026, CERT-In published vulnerability note CIVN-2026-0459, describing two critical flaws in Check Point VPN products. An unauthenticated remote attacker can trigger both by sending specially crafted certificate data while a VPN connection is being negotiated.

Overview

The flaws affect Check Point VPN components: Security Gateway, Security Management Server, and Spark Firewall. CERT-In rates the overall risk as critical. Successful exploitation can end in arbitrary code execution on the target, and the advisory points to complete compromise of an affected Security Gateway or Security Management Server as a realistic outcome.
Check Point has released fixes through two support articles, sk1000117 and sk1000118.

How the flaws work

CERT-In identifies two root causes in the VPN certificate processing path.
The first is improper certificate validation. During VPN negotiation the implementation fails to verify certificate material rigorously, so forged certificate data can be accepted by a device that should reject it.
The second is a heap-based buffer overflow. When the same certificate processing code parses crafted data, it writes past the end of an allocated heap buffer. Corrupted heap memory is a well-known route to control flow hijacking, which is why these flaws end in code execution rather than a simple crash.

Exploitation conditions

The attack surface is the VPN negotiation itself:

• The attacker needs network reachability to the VPN endpoint.
• No authentication is required before the malicious certificate is processed.
• A single crafted certificate submitted during negotiation is enough to reach the vulnerable code. These conditions make internet-exposed VPN gateways the primary concern. A device that only accepts connections from known networks is much harder to reach, although threats from inside the network remain possible. ## Impact CERT-In's assessment lists several outcomes: arbitrary code execution, complete compromise of the affected Security Gateway or Security Management Server, unauthorized access to sensitive information, and disruption of network operations. A compromised VPN gateway also gives an attacker a position at the network edge, where they can observe or manipulate traffic that passes through it. ## Affected products and versions Per CERT-In note CIVN-2026-0459:
• Affected supported versions: R81.20, R82, R82.10, R81.10.x, and R82.00.x of Security Gateway, Security Management Server, and Spark Firewall.
• End-of-support versions: R80 through R80.40, R81, and R81.10.
• R82.20 is listed as not affected. ## Remediation Check Point has published fixes in support articles sk1000117 and sk1000118. Administrators should apply the updates on every affected gateway and management server. Systems still running end-of-support versions need a migration to a supported, fixed release, because those versions will not receive the patch. As an interim measure, limiting reachability of the VPN service to trusted networks reduces exposure while updates are rolled out. ## Sources
• CERT-In Vulnerability Note CIVN-2026-0459, September 16, 2026.
• Check Point support articles sk1000117 and sk1000118.