Affected Systems

Check Point Quantum Security Gateway, Security Management Server, and Spark Firewall. Affected versions: R82.10 (Jumbo Hotfix Take 43 or below), R82 (Take 125 or below), R81.20 (Take 165 or below). Spark Firewall versions not specified. Flaws affect VPN certificate handling; CVE-2026-85102 impacts Security Gateways, CVE-2026-85103 impacts both Gateways and Management Servers.

Exploitation Status

No evidence of active exploitation. Check Point discovered both flaws internally and states no indication of in-the-wild use. No proof-of-concept publicly available. Exploitation requires "specific conditions" not disclosed by vendor.

Business Impact

Unauthenticated remote code execution on internet-facing VPN endpoints and management infrastructure. CVE-2026-85102 exploits improper certificate trust validation during VPN negotiation. CVE-2026-85103 is a heap-based buffer overflow in ASN.1 certificate decoding. Both rated CVSS 9.8 by vendor. Gateways with VPN blade disabled may still be vulnerable if VPN certificates are present. Patch delivery issues reported: some customers on R81.10 have no available fix, automatic Live Patch rollout incomplete, and download links failing for multiple users. No indicators of compromise published; unclear if remediation removes existing attacker access.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately inventory all Check Point Security Gateways, Security Management Servers, and Spark Firewalls exposed to VPN traffic or certificate processing.
  • Apply Check Point Live Patch for R81.20, R82.00, and R82.10 systems; verify installation via SmartConsole or CLI, as automatic rollout has been incomplete.
  • Install latest Jumbo Hotfix for your deployed version once available; prioritize R82.10 (Take 44+), R82 (Take 126+), and R81.20 (Take 166+).
  • For R81.10 and other unsupported versions without patches, engage Check Point support for mitigation guidance on disabling implied VPN rules and assess upgrade feasibility within 48 hours.
  • Monitor VPN and certificate processing logs for anomalous connection attempts or certificate validation failures; review sk1000117 and sk1000118 advisories for updated remediation steps.