Patching the Check Point VPN flaws: a prioritized response plan for CVE-2026-85102 and CVE-2026-85103

When CERT-In issued note CIVN-2026-0459 on September 16, 2026, it described two critical Check Point VPN flaws that an unauthenticated remote attacker can exploit with crafted certificate data during VPN negotiation. This article lays out a response order for administrators who need to patch without breaking their remote access infrastructure.

What you are dealing with

The two flaws sit in VPN certificate processing. One is improper certificate validation; the other is a heap-based buffer overflow. Either can be reached by an unauthenticated attacker who sends a crafted certificate to the VPN endpoint. CERT-In's impact assessment covers arbitrary code execution, complete compromise of an affected Security Gateway or Security Management Server, unauthorized access to sensitive information, and disruption of network operations.

Step 1: build the inventory

List every Security Gateway, Security Management Server, and Spark Firewall in the estate, with its version. Supported affected versions are R81.20, R82, R82.10, R81.10.x, and R82.00.x. End-of-support versions R80 through R80.40, R81, and R81.10 are also affected and need a different path, described below. R82.20 is not affected.
Internet-facing gateways go to the top of the list. The flaw requires no credentials, so any reachable VPN endpoint is exposed to the full attack.

Step 2: apply the vendor fixes

Check Point published the fixes in support articles sk1000117 and sk1000118. Apply them to gateways and management servers in that priority order. Schedule maintenance windows as usual for gateway upgrades, but treat internet-facing systems as urgent.

Step 3: handle end-of-support systems

R80 through R80.40, R81, and R81.10 do not receive the fix. The only remediation is migration to a supported, fixed release. Until migration completes, isolate those systems from untrusted networks.

Step 4: reduce exposure during rollout

While updates are in progress:

• Restrict VPN service reachability to trusted networks and management ranges where the architecture allows it.
• Monitor VPN negotiation logs for unusual certificate activity.
• Re-scan the edge after patching to confirm no vulnerable gateway remains reachable. ## Sources
• CERT-In Vulnerability Note CIVN-2026-0459, September 16, 2026.
• Check Point support articles sk1000117 and sk1000118.