Vulnerabilities & Exploits

Check Point VPN flaws move into exploitation window

The Dutch NCSC said exploitation of two critical Check Point VPN flaws is imminent on day 2 of the disclosure, turning CVE-2026-85102 and CVE-2026-85103 into a near-term problem for Quantum Security Gateway and Quantum Security Management. Check Point has emergency fixes for supported R81.20 and R82 branches.

The bugs sit in the VPN certificate path: one can trick the gateway into trusting a bad handshake, and the other mishandles certificate data while it is being decoded. In both cases, an attacker who reaches that trust check can get code execution before the connection is accepted, so the issue is at the perimeter and not on a logged-in user’s desktop.

The lasting exposure is the legacy R80 and R81 fleet. Supported branches can be patched, but end-of-support gateways may never get a fix, so the blast radius is whatever older Check Point appliances remain in service.

7 sources · Sep 12

CVE-2026-85102

NVD KEV

Known exploited · CISA KEV

CVSS 9.8 CRITICAL: improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an…

CISA federal remediation date Sep 25

CVE-2026-85103

NVD KEV

CVSS 9.8 CRITICAL: a heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to…

Timeline

Sources

Part of the PlainSec briefing for 2026-09-11

Every edition of this story: Check Point VPN flaws move into exploitation window

More from today