Check Point has disclosed two critical vulnerabilities, both carrying a CVSS score of 9.8, residing within the certificate handling logic of its Quantum VPN infrastructure. These flaws, identified as CVE-2026-85102 and CVE-2026-85103, allow unauthenticated remote attackers to execute arbitrary code without user interaction. Both vulnerabilities were discovered internally by Check Point, and there are no reports of active exploitation as of September 9, 2026.
The vulnerabilities exist within the same certificate verification layer, specifically during the VPN negotiation phase before authentication is finalized. The authentication gap, a recurring pattern in recent enterprise software vulnerabilities, describes this failure where systems process untrusted data before confirming the legitimacy of the requestor.
This pattern has appeared across the industry, including incidents involving PaperCut, N-able, Microsoft, SAP, and Ivanti. Each instance highlights a systemic weakness where the authentication perimeter is bypassed before the system validates the identity of the connecting entity.
CVE-2026-85102 involves improper validation of certificate data, categorized under CWE-295. This flaw specifically affects Security Gateways. In contrast, CVE-2026-85103 is a heap-based buffer overflow (CWE-122) occurring during ASN.1 decoding of VPN certificates. This second vulnerability carries a broader scope, impacting both Security Gateways and the Security Management Server, which serves as the central management plane for the infrastructure.
This discovery follows a series of similar authentication bypass incidents across the industry. While these new Check Point flaws share the pre-authentication characteristic, they are distinct from the June 2026 incident involving CVE-2026-50751, which CISA added to its Known Exploited Vulnerabilities (KEV) catalog. That earlier vulnerability was a protocol-level issue in IKEv1 key exchange, whereas the current flaws are rooted in the certificate validation and decoding path.
The potential impact is substantial given the prevalence of these devices. As of June 2024, Censys data indicated approximately 13,754 internet-exposed Check Point VPN devices globally, with roughly 1,021 identified as Quantum Security Gateways and over 900 located within the United States. Because these vulnerabilities are triggered during the initial negotiation phase, they represent a direct threat to the remote access perimeter.
For remediation, Check Point advises that R82.20 is the only current version unaffected by these flaws. For other supported versions, including R81.20, R82, and R82.10, administrators should apply LivePatch Take 24 or the Jumbo Hotfix R82 Take 126. Organizations running End-of-Support (EoS) versions, such as R80 through R81.10, must upgrade to a supported release to receive the necessary patches. As a temporary mitigation for Site-to-Site VPN configurations, administrators can disable implied rules for VPN and manually define access for UDP/500 and UDP/4500 for specific, trusted peer IP addresses. This mitigation is not applicable to Spark Firewalls.
The inclusion of the Security Management Server in the scope of CVE-2026-85103 creates a high-risk vector for administrative compromise. Because the management server controls the security policy for the entire enterprise, an unauthenticated exploit here could allow an attacker to bypass all downstream security controls. Practitioners should prioritize patching the management plane immediately, followed by all edge gateways, to ensure the integrity of the remote access infrastructure as detailed by SecurityOnline.info.