Measuring the Check Point VPN exposure: what internet scanning shows after CVE-2026-85102 and CVE-2026-85103

CERT-In published note CIVN-2026-0459 on September 16, 2026, warning that Check Point VPN products contain two critical flaws, CVE-2026-85102 and CVE-2026-85103, both reachable by an unauthenticated remote attacker during VPN negotiation. Beyond the technical detail, one question matters for defenders: how much of this attack surface is visible on the public internet?

The vulnerability in brief

The flaws combine improper certificate validation with a heap-based buffer overflow during VPN certificate processing. Successful exploitation can yield arbitrary code execution and complete compromise of an affected Security Gateway or Security Management Server. Supported releases R81.20, R82, R82.10, R81.10.x, and R82.00.x are affected, as are end-of-support releases R80 through R80.40, R81, and R81.10. R82.20 is not affected. Fixes are available in Check Point support articles sk1000117 and sk1000118.

What a ZoomEye query shows

A query against the ZoomEye cyberspace search engine on September 17, 2026 at 16:15 UTC used the following dork:

product="Check Point" && (service="https" || service="ssl")

The query matched 208,666 assets. A second query filtering for the CVE identifier directly, vul.cve="CVE-2026-85103", returned zero records at the same time.
These numbers need careful reading. The 208,666 figure counts assets whose fingerprint identifies Check Point products running HTTPS or SSL services. It does not confirm that any of those assets runs a vulnerable version. The zero result on the CVE filter reflects the absence of CVE-indexed records, not proof that no vulnerable host exists. Product-query exposure describes matching product assets, so a defender should treat it as an upper bound on the population worth checking first.

Using the measurement

For a network owner, the practical use of such a query is inventory. Comparing externally visible Check Point services against your fixed-update records tells you whether any gateway is still reachable before it is patched. For incident response teams, the same query scoped with organization or network fields identifies gateways that may need priority verification.

Remediation

Apply the vendor updates from sk1000117 and sk1000118 to all affected releases. Systems on end-of-support versions require migration to a supported, fixed release. Restricting VPN service reachability to trusted networks lowers exposure while patching completes.

Sources

• CERT-In Vulnerability Note CIVN-2026-0459, September 16, 2026.
• Check Point support articles sk1000117 and sk1000118.
• ZoomEye query record, product and service dork, 208,666 matches, checked September 17, 2026 16:15 UTC.