Affected Systems

Check Point Security Gateway, Security Management Server, and Spark Firewall (all versions R80 through R82.10) configured with Remote Access VPN or Site-to-Site VPN. CVE-2026-85102 affects Security Gateway only; CVE-2026-85103 affects both Security Gateway and Security Management Server.

Exploitation Status

No public evidence of active exploitation reported. Emergency patches released 9 September 2026. No PoC publicly available at time of advisory.

Business Impact

Unauthenticated remote code execution on perimeter security appliances and management infrastructure. CVSS 9.8 (Critical). Attackers can fully compromise VPN-enabled gateways and management servers without credentials. High risk for organizations with internet-facing Check Point VPN deployments. Potential for lateral movement, credential theft, and persistent access to network perimeter.

Urgency

đź”´ Immediate

Recommended Actions

  • Apply Check Point hotfixes immediately for CVE-2026-85102 and CVE-2026-85103, prioritizing internet-facing Security Gateways and Security Management Servers
  • Identify all Check Point deployments (R80 through R82.10) with Remote Access VPN or Site-to-Site VPN enabled using asset inventory and configuration management tools
  • Monitor VPN authentication logs and Security Gateway system logs for anomalous connection attempts, certificate validation errors, or unexpected process execution during the VPN negotiation phase
  • Implement network segmentation or temporary access restrictions for Check Point management interfaces until patches are applied
  • Verify patch deployment success and confirm running software version matches patched release using Check Point SmartConsole or CLI (cpinfo, fw ver)

---

# Geopolitical Context

Geopolitical Context

The disclosure of two critical remote code execution vulnerabilities (CVE-2026-85102 and CVE-2026-85103) in Check Point VPN products represents a significant exposure for European Union perimeter defenses. Check Point appliances are widely deployed across EU member state government networks, critical infrastructure operators, and enterprise environments, particularly in telecommunications and energy sectors. The vulnerabilities affect both Security Gateway and Security Management Server products configured with VPN—a near-ubiquitous deployment pattern for remote access and site-to-site connectivity. The CVSS 9.8 severity rating and the unauthenticated remote exploitation vector make these flaws attractive targets for state-sponsored cyber operations seeking persistent access to high-value networks. CERT-EU's rapid advisory issuance underscores institutional concern about exploitation risk during the patching window, particularly given the vulnerabilities' presence in internet-facing infrastructure.

State Actor Alignment

No specific threat actor attribution is provided in the advisory. However, the vulnerability class—improper certificate validation and heap overflow in VPN negotiation flows—is consistent with exploitation techniques previously associated with advanced persistent threat (APT) groups linked to Russian, Chinese, and Iranian intelligence services. State-sponsored actors have historically prioritized VPN and perimeter device vulnerabilities for initial access operations, as demonstrated by prior campaigns targeting Pulse Secure, Fortinet, and Cisco products. The timing and technical characteristics may prompt intelligence services in EU member states to review network logs for indicators of pre-disclosure exploitation, though no evidence of in-the-wild abuse has been publicly reported as of the advisory date. The vulnerabilities' impact on Security Management Servers—which centrally administer firewall policies—elevates the strategic value for actors seeking broad network visibility or policy manipulation capabilities.

Business Impacty pro region

The vulnerabilities pose acute risk to EU institutional networks and member state critical infrastructure, where Check Point products maintain significant market share in telecommunications, energy, and government sectors. The exposure is particularly pronounced for organizations operating legacy R80 and R81 versions, some of which have reached end-of-support status, potentially complicating patch deployment. EU telecommunications providers relying on Check Point for carrier-grade VPN services face operational continuity challenges if emergency patching disrupts service availability. The advisory's emphasis on prioritizing "internet-facing and perimeter appliances" reflects the reality that many EU organizations maintain hybrid on-premises/cloud architectures with VPN as a critical trust boundary. Beyond Europe, the vulnerabilities affect global enterprises and government networks using Check Point products, with potential cascading effects on transatlantic data flows and supply chain security if exploitation enables lateral movement into partner networks. The incident may accelerate EU policy discussions around mandatory vulnerability disclosure timelines and coordinated patching requirements for critical infrastructure operators under the NIS2 Directive framework.

Forecast

If exploitation tools or proof-of-concept code for CVE-2026-85102 and CVE-2026-85103 become publicly available before widespread patching is completed, a significant increase in scanning and exploitation attempts targeting EU networks is likely within 7-14 days. Organizations that delay hotfix deployment beyond the initial 72-hour window may face elevated risk of compromise, particularly if threat actors develop automated exploitation capabilities. If evidence emerges of pre-disclosure exploitation by state-sponsored groups, EU member state cybersecurity agencies are likely to issue supplementary guidance on forensic indicators and recommend expanded log retention and analysis. The incident may prompt Check Point to accelerate end-of-life transitions for R80 and R81 product lines, potentially forcing infrastructure upgrades among EU operators still running legacy versions. If similar vulnerabilities are discovered in competing VPN products in the coming months, the pattern may drive renewed policy focus on secure-by-design requirements for network security appliances procured by EU institutions and critical infrastructure operators.