Check Point VPN Flaws CVE-2026-85102 and CVE-2026-85103: Why Pre-Authentication RCE on the Perimeter Demands Fast Patching

Vulnerability overview

On September 16, 2026, CERT-In published CIVN-2026-0459, a CRITICAL-rated note covering multiple vulnerabilities in Check Point VPN products. The note lists CVE-2026-85102 and CVE-2026-85103 and identifies Security Gateway, Security Management Server, and Spark Firewall as affected.
The operational question for most teams is not the internal structure of the bugs but the order in which to patch and what to do in the meantime. This article covers the deployment side.

Mechanism and exploitation conditions

CERT-In describes two weaknesses in the VPN certificate processing path: improper certificate validation and a heap-based buffer overflow. An unauthenticated remote attacker exploits them by supplying specially crafted certificate data during the VPN negotiation phase.
The relevant property for defenders is that the trigger arrives during negotiation, before authentication completes. There is no credential to steal and no session to hijack first. Any host that can reach the VPN negotiation service can attempt to send the crafted data. CERT-In does not disclose a proof-of-concept or the exact certificate field involved.

Impact

Exploitation could let an unauthenticated attacker execute arbitrary code, potentially resulting in complete compromise of the affected Security Gateway or Security Management Server, unauthorized access to sensitive information, and disruption of network operations.
The blast radius differs by product. A compromised Security Gateway is a foothold at the network edge. A compromised Security Management Server is worse in a different way, because it holds the policy and configuration that many gateways depend on. CERT-In's mention of information access and service disruption covers both cases.

Affected products and scope

Affected products: Security Gateway, Security Management Server, Spark Firewall.
Affected supported versions: R81.20, R82, R82.10, R81.10.x, R82.00.x. Affected end-of-support versions: R80 through R80.40, R81, R81.10. Not affected: R82.20.
The end-of-support entries change the remediation plan. A fleet that includes R80 or R81 devices cannot be closed by applying a maintenance patch alone; those devices need to move to a supported release. CERT-In does not indicate whether every product and version combination is vulnerable to both CVEs.

Exposure context

ZoomEye returns 1,852 instances for app="Check Point VPN". This is a count of fingerprinted Check Point VPN assets, not a count of vulnerable deployments. Version, patch state, and whether the negotiation service faces an untrusted network all sit outside what the fingerprint confirms. A vul.cve="CVE-2026-85102" query returned zero, consistent with a newly assigned CVE that is not yet indexed.

Remediation and mitigations

Check Point published sk1000117 and sk1000118. Apply the update for each deployed product and version.
A practical sequence for a mixed fleet:

Inventory the Check Point estate and record the running version of each Security Gateway, Security Management Server, and Spark Firewall.
Patch supported devices on R81.20, R82, R82.10, R81.10.x, and R82.00.x using the vendor guidance.
Schedule upgrades for R80 through R80.40, R81, and R81.10 devices, which are affected and out of support.
Restrict access to the VPN negotiation service to known peer addresses where the business allows it. This reduces who can send crafted certificate data but does not fix the flaw.
After each change, confirm the running build matches the fixed version in the advisory. Because the flaw is triggered before authentication, authentication logs are a weak detection source. Version verification and reachability review are the dependable checks.