On September 9, 2026, Check Point released fixes for two critical VPN certificate vulnerabilities, CVE-2026-85102 and CVE-2026-85103, both rated CVSS 9.8. The situation has since changed: Check Point and the Dutch NCSC now report exploitation of CVE-2026-85102. The vendor says it has observed attempts against Spark customers since September 12.
This observation concerns CVE-2026-85102 and does not prove that any particular gateway was compromised. It should not automatically be extended to CVE-2026-85103 either. Organizations should check affected versions and configurations in the official advisories, apply the matching fix and look for unusual activity.
The two vulnerabilities and their scope
CVE-2026-85102 involves improper validation of certificate data during VPN negotiation; it may allow unauthenticated remote code execution on an affected Security Gateway. CVE-2026-85103 is a heap overflow during ASN.1 decoding of VPN certificates and may also lead to unauthenticated code execution.
Products listed include Check Point Security Gateway and Spark Firewall. The Cyber Security Agency of Singapore also includes Security Management Server in the scope of CVE-2026-85103. Affected versions vary by CVE; its advisory lists R82.20 as unaffected. Always check the vendor’s current version table instead of inferring exposure from a product name alone.
What is known about exploitation
At disclosure on September 9, Check Point said it had no indication of exploitation. The Dutch NCSC later reported exploitation of CVE-2026-85102. In a subsequent update, Check Point said it had observed attempts against Spark customers in several regions starting September 12.
The practical recommendation is clear: treat CVE-2026-85102 as exploited and patch it promptly. For CVE-2026-85103, the sources cited here establish its severity and the availability of fixes, but do not report the same exploitation observation. This distinction avoids attributing evidence about one flaw to the other.
Priority fixes and checks
Inventory Security Gateways, Spark Firewalls and Security Management Servers, noting their versions, builds and enabled VPN features. Consult Check Point advisories SK1000117 and SK1000118, then install the Jumbo Hotfix or fix recommended for each version. Do not apply instructions for a different build.
After installation, confirm the build number and review VPN connection logs. Check Point advises looking for unusual certificate-based Mobile Access logins and suspicious activity that may follow a session. The vendor’s published list of certificate names is not exhaustive, so it should not be the only search filter.
If deployment of the fix must wait
For a Site-to-Site VPN that cannot be patched immediately, Singapore’s Cyber Security Agency relays a temporary Check Point measure: disable implied VPN rules and restrict UDP ports 500 and 4500 to known peer IP addresses. This measure does not apply to locally managed Spark Firewalls.
Have the network team validate any temporary restriction to avoid interrupting legitimate access. It does not replace installing the fix. For Remote Access VPN or another configuration, follow the matching vendor instructions instead of applying this measure outside its stated scope.
The Soclyde connection
Soclyde cannot patch Check Point appliances or detect their exploitation. Its local encrypted vault can help a team store and share unique access secrets for its equipment under its internal rules. If a compromise is suspected, credentials must be revoked or rotated in the affected systems.
For small-team access practices, see our team password-sharing guide and secure password guide.
Takeaway
CVE-2026-85102 is reported as exploited; Check Point has observed attempts since September 12. CVE-2026-85103 is a second critical flaw, but exploitation reported for the first should not be attributed to it without evidence. Identify your builds, apply the official fixes and review VPN logs. You can contact Soclyde to learn more about team secret management.
