2026-012: Critical Vulnerabilities in Check Point Products

Two critical vulnerabilities (CVE-2026-85102 and CVE-2026-85103, CVSS 9.8) in Check Point Security Gateway, Security Management Server, and Spark Firewall products allow unauthenticated remote attackers to execute arbitrary code — requiring zero credentials to exploit. The severity is compounded by the fact that these products are specifically used for VPN access, meaning they are internet-facing by design and exposed to the widest possible threat surface. Organizations that delay applying emergency patches to these appliances risk complete perimeter compromise, potentially granting attackers a foothold into the entire internal network. This incident underscores how unpatched network security appliances are among the highest-value targets for threat actors, as a single exploit can bypass all downstream defenses.