End-of-support systems are the quiet risk in the Check Point VPN advisories

CERT-In note CIVN-2026-0459, published September 16, 2026, describes two critical flaws in Check Point VPN products: improper certificate validation and a heap-based buffer overflow during certificate processing. An unauthenticated remote attacker can exploit both by presenting crafted certificate data during VPN negotiation, with potential outcomes including arbitrary code execution and complete compromise of the affected system.
Most coverage of advisories like this focuses on the patched releases. The version table in this note deserves equal attention, because it separates two very different situations.

The affected version landscape

The note lists affected supported versions as R81.20, R82, R82.10, R81.10.x, and R82.00.x across Security Gateway, Security Management Server, and Spark Firewall. R82.20 is not affected. Those systems get a straightforward fix from Check Point support articles sk1000117 and sk1000118.
The second group is different: R80 through R80.40, R81, and R81.10, all end-of-support. These versions are affected and will not receive the fix.

Why the second group is the harder problem

For supported versions, the response is a maintenance window and a patch. For end-of-support versions, the only remediation is migration to a supported, fixed release, which takes planning: configuration review, compatibility checks, testing, and scheduling. Organizations running these versions face a period in which a critical, pre-authentication flaw remains exploitable on their edge.
Migration under deadline pressure is also where operational mistakes happen. A rushed upgrade of a VPN gateway can disrupt remote access for the whole organization, which is a business risk on top of the security one.

A practical sequence

• Confirm which devices run end-of-support versions and whether they are internet-facing.
• Isolate unpatched systems from untrusted networks immediately.
• Plan the migration to a fixed supported release, starting with externally reachable gateways.
• Verify the final state with a post-migration scan. ## Sources
• CERT-In Vulnerability Note CIVN-2026-0459, September 16, 2026.
• Check Point support articles sk1000117 and sk1000118.