Check Point VPN Holes Are CVSS 9.8 and Unauthenticated: Patch the Front Door First

Two CVSS 9.8 holes in Check Point’s VPN stack landed this week, and both are unauthenticated. For African enterprises that trust a single box at the network edge to keep the internet out, that is the worst possible place for a bug.

What Check Point disclosed

Check Point published patches this week for two critical-severity vulnerabilities in its gateway and firewall products that handle VPN traffic. The company tracks them as CVE-2026-85102 and CVE-2026-85103, and both score 9.8 on the CVSS scale. Neither requires authentication. Both lead to remote code execution.

The mechanics differ. CVE-2026-85102 is an improper validation of certificate data during VPN negotiation. CVE-2026-85103 is a heap overflow in the ASN.1 decoding flow that handles VPN certificates. If you have followed edge-device security for the past few years, the second one should feel familiar. Certificate parsing bugs in VPN appliances have a long track record: the Citrix NetScaler ADC breach of 2025 started the same way, in the code that runs before any login screen exists.

The blast radius covers Security Gateway, the Security Management Server, and Check Point Spark Firewall, on any deployment using Site to Site VPN or Remote Access VPN. Patches are out for R82.10, R82, and R81.20.

The mitigation is a config change, and most shops will skip it

Until patches go in, Check Point’s workaround is manual VPN rule definition: disable implied rules for VPN and explicitly allow UDP/500 and UDP/4500 only for known peer IP addresses. That is sound advice for a Site to Site link with five branch offices. It is a different story for a bank with three hundred roaming users connecting over Remote Access VPN, where the peer list keeps changing and nobody wants to babysit firewall rules during a patch backlog.

There is one more wrinkle. The mitigation does not apply to locally managed Spark Firewall instances at all. If your branch offices run Spark boxes managed on-site rather than through the cloud console, your only path is the Jumbo hotfixes, applied as soon as possible. Customers with LivePatch enabled get the fixes pushed automatically. Good. Now count how many of your sites actually have LivePatch switched on. In our audits of mid-size South African companies, the answer is usually “the head office does, and maybe two regions.”

Why this matters more on this continent

Check Point says it found both bugs internally and has no evidence of exploitation in the wild. Enjoy that window, because it is the entire point of this warning. The pattern across every major edge-device breach of the last five years runs the same way: vendor discloses, vendor says “no known exploitation,” a scanning swarm finds the unpatched estate within days, and the ransomware crews arrive within weeks. Firewall and VPN appliances sit in a strange position in most enterprises. They are the most trusted devices on the network, they are patched on a quarterly change-control rhythm, and no EDR agent watches them from the inside.

African enterprises lean on this hardware harder than most. A Johannesburg fintech connecting satellite offices in Lagos and Nairobi through Check Point Site to Site tunnels is not an unusual architecture here. Neither is a retail group where the firewall config is managed by an MSP in another country and nobody local has root-level visibility. When the front door itself has a hole in it, “we have a firewall” stops being an answer.

What to do this week

1. Inventory first. You cannot patch what you do not know about. List every Security Gateway, Management Server, and Spark instance, including branch boxes under MSP contracts.
2. Confirm the management plane. The 9.8-rated CVE-2026-85103 hits the Security Management Server. If an attacker owns the console that writes your policies, they own every gateway it feeds.
3. Patch R82.10, R82, and R81.20 now, not at the next change window. Unauthenticated RCE on an internet-facing interface does not wait for Thursday’s CAB meeting.
4. Apply the manual VPN rules where practical, and for locally managed Spark instances that cannot, get the Jumbo hotfix scheduled this week.
5. Assume the pre-patch window is burned. Pull VPN negotiation logs from the last 90 days and have someone actually look at them for anomalous certificate behavior.

The eHawu view

Patch cycles are necessary and never sufficient. The real defense for an African enterprise is network-layer visibility that does not depend on the appliance policing itself. eHawu’s zero-trust access platform puts every connection through per-session identity verification with continuous telemetry, so a hostile session on your VPN segment shows up as an anomaly the moment it starts, not in a forensic review three weeks later. If your remote access story still begins and ends with “we have a Check Point box,” this week’s disclosure is your prompt to write a better one.