Source context: this article examines information published by the source on September 10, 2026. This site’s publication date is shown separately. Check the latest vendor guidance before acting.
What the vulnerability is
Two critical vulnerabilities have been identified in Check Point security appliances that could allow an unauthenticated, remote attacker to execute arbitrary code.
CVE-2026-85102 involves improper certificate-data validation within the VPN negotiation flow. CVE-2026-85103 is a heap overflow vulnerability located in the VPN certificate ASN.1 decoding flow. While both allow for remote code execution, they differ in scope: CVE-2026-85102 affects the Security Gateway, whereas CVE-2026-85103 affects both the Security Gateway and the Security Management Server.
Exposure and applicability
These vulnerabilities specifically impact deployments configured for Remote Access VPN or Site-to-Site VPN. For healthcare organizations, these configurations are frequently used to facilitate secure remote clinician access to electronic protected health information (ePHI) and to maintain encrypted tunnels between clinical sites or with business associates.
The affected products include:
* Check Point Security Gateway: Versions R80 through R82.10 (including various .X releases).
* Check Point Security Management Server: Versions corresponding to the affected Gateways.
* Check Point Spark Firewall: Both Centrally and Locally Managed versions across the aforementioned version ranges.
Remediation priorities
Our analysis suggests that healthcare security leaders should prioritize remediation based on the appliance’s position in the network. Perimeter devices and internet-facing gateways represent the highest risk of unauthenticated external access.
Prioritized Actions:
1. Immediate Patching: Apply the emergency security updates/hotfixes released on September 9, 2026. This is the primary method to address the underlying code flaws in the VPN negotiation and decoding flows.
2. Inventory Audit: Identify all instances of Security Gateways, Management Servers, and Spark Firewalls across the environment to ensure no legacy or shadow IT appliances remain unpatched.
3. Configuration Review: Verify which appliances are actively configured for Remote Access or Site-to-Site VPNs to prioritize the order of updates.
How to validate remediation
To verify that exposure has been reduced, security teams should perform a version check on all identified Check Point appliances to confirm that the emergency hotfixes have been successfully applied. This validation should be coordinated with network operations to ensure that the update process did not disrupt active VPN tunnels essential for patient care continuity.
Limits and open questions
Applying these hotfixes addresses the specific vulnerabilities identified in the certificate validation and decoding flows; however, it does not guarantee immunity from other potential VPN-related attack vectors.
It remains unknown if these vulnerabilities have been exploited in the wild prior to the release of the advisory. Additionally, while internet-facing devices are the most immediate concern, internal appliances used for inter-facility Site-to-Site VPNs may still be vulnerable to lateral movement should an attacker gain a foothold within the internal network.
Source and editorial note
Security Advisory 2026-012 · Source date: September 10, 2026 · Retrieved September 14, 2026.
Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.
Request a healthcare security assessment
Turn healthcare security intelligence into action.
Discuss your environment, priorities, and the evidence needed to validate safeguards.
Request a healthcare assessment ↗