Check Point CVE-2026-85102 / 85103: Two 9.8 VPN Flaws with Unauthenticated RCE, Exploitation Called Imminent

> TL;DR: On September 9, 2026, Check Point fixed two critical vulnerabilities in how its firewalls and management consoles handle VPN certificates. CVE-2026-85102 (CVSS 9.8) is a failure to properly validate certificate trust during VPN negotiation, potentially enabling unauthenticated remote code execution on Security Gateways. CVE-2026-85103 (CVSS 9.8) is a heap-based buffer overflow while decoding a certificate's ASN.1 structure, affecting Quantum Security Management and Quantum Security Gateway systems. Check Point, which found both flaws internally, says it has no evidence of exploitation — but the Dutch NCSC warns exploitation is imminent. Affected versions: R82.10 (JHF Take 43 and below), R82 (Take 125 and below), R81.20 (Take 165 and below).

The mechanism: the certificate as attack surface

Both flaws trigger during certificate processing — attacker-controlled input in VPN flows. The first breaks trust validation (a malicious certificate passes as legitimate, with potential code execution on the gateway); the second corrupts memory during ASN.1 decoding (heap overflow, same outcome). Two important Check Point clarifications:

The vendor's context presses: in June, CVE-2026-50751 (Remote Access VPN authentication bypass) was already exploited at disclosure (KEV June 8); in July, CVE-2026-16232 (SmartConsole) was KEV'd the same day. Check Point VPN flaws have a history: they convert into access fast.

The editorial response blind spots

The case also offers operational lessons, reported by customers on the community forum: R81.10 branches with no patch path (mitigation only, described as too vague to apply), a progressive Live Patch rollout that had not reached all appliances days after the announcement, broken download links, and no published IoCs — logical, since no public exploit exists yet. For your teams: do not assume the fix is applied because it is available; verify the effective version on every appliance, including secondary lines (Spark, management).

What to do

The broader lesson

Firewalls and VPN concentrators are the most systematically converted initial-access category of the past three years (Ivanti, Fortinet, Palo Alto, Citrix, SonicWall, and now Check Point repeatedly). The reason is structural: they are exposed by function, they process unauthenticated input (certificates, handshakes), and compromising them delivers the inside of the network. Two consequences for every organization: their patch cycle must be the shortest in the estate (hours, not weeks), and the assumption "the VPN may be compromised" must exist in the architecture — segmentation behind the gateway, MFA on internal resources, monitoring of accounts transiting through it.