[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzcfzLttgo1Ha7AbWi7WYGuUCn6-jkwTLKvfgeBX3UN4":3},{"article":4,"iocs":45,"watch_terms":53,"solutions":54,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"d18cadac-99fe-4cd0-87e3-bfdbf6438211","2026-012: Critical Vulnerabilities in Check Point Products","2026-012-critical-vulnerabilities-in-check-point-products-75307c","On 9 September 2026, Check Point released emergency security updates addressing two critical vulnerabilities affecting Check Point Security Gateway, Security Management Server, and Spark Firewall deployments configured to use Remote Access VPN or Site-to-Site VPN. Both vulnerabilities carry a CVSS score of 9.8 and could allow an unauthenticated, remote attacker to execute arbitrary code on affected appliances. CERT-EU strongly recommends applying the available hotfixes as soon as possible, prioritising internet-facing and perimeter appliances.","Check Point has issued emergency security updates to address two critical vulnerabilities, CVE-2026-85102 and CVE-2026-85103, affecting their Security Gateway, Security Management Server, and Spark Firewall products. Both vulnerabilities have a CVSS score of 9.8 and allow unauthenticated, remote attackers to execute arbitrary code on affected appliances, particularly those configured for Remote Access VPN or Site-to-Site VPN.","Check Point releases emergency updates for two critical VPN vulnerabilities.","https:\u002F\u002Fcert.europa.eu\u002Fpublications\u002Fsecurity-advisories\u002F2026-012\u002F","https:\u002F\u002Fcert.europa.eu\u002Ffiles\u002Fimages\u002Fcerteu_home_share-v2.png","2026-09-10T08:20:06+00:00","2026-10-31T10:00:29.349452+00:00",9,[17,20,23,25],{"name":18,"type":19},"Check Point","vendor",{"name":21,"type":22},"Check Point Security Gateway","product",{"name":24,"type":22},"Check Point Security Management Server",{"name":26,"type":22},"Spark Firewall","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,40],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,50],{"type":47,"value":48,"context":49},"cve","CVE-2026-85102","Improper certificate-data validation vulnerability in VPN negotiation flow.",{"type":47,"value":51,"context":52},"CVE-2026-85103","Heap overflow vulnerability in VPN certificate ASN.1 decoding flow.",[18,21,24],{"controls":55,"vendors":142},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":86,"name":87,"problem":88,"products":89},"patch-management","Automated patch management","Known holes get closed in days, not months.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":115,"name":116,"problem":117,"products":118},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[119,126,134],{"vendor_slug":120,"vendor_name":18,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"check-point","\u002Fvendor-logos\u002Fcheck-point.png","quantum-firewall","Quantum Force firewalls","https:\u002F\u002Fwww.checkpoint.com\u002Fquantum\u002Fnext-generation-firewall\u002F","Next-generation firewalls with threat prevention.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"clavister","Clavister","\u002Fvendor-logos\u002Fclavister.png","clavister-netwall","Clavister NetWall","https:\u002F\u002Fwww.clavister.com\u002Fproducts\u002Fclavister-netwall\u002F","Next-generation firewalls developed in Sweden.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png","fortigate","FortiGate","https:\u002F\u002Fwww.fortinet.com\u002Fproducts\u002Fnext-generation-firewall","Next-generation firewalls with intrusion prevention and SD-WAN.",[143],{"slug":120,"name":18,"logo_path":121,"roles":144},[145],"affected",{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":158},"critical-rce-vulnerabilities-in-check-point-vpn-products-demand-immediate-patching","Critical RCE Vulnerabilities in Check Point VPN Products Demand Immediate Patching","Two critical vulnerabilities (CVE-2026-85102 and CVE-2026-85103, CVSS 9.8) in Check Point Security Gateway, Security Management Server, and Spark Firewall products allow unauthenticated remote attackers to execute arbitrary code — requiring zero credentials to exploit. The severity is compounded by the fact that these products are specifically used for VPN access, meaning they are internet-facing by design and exposed to the widest possible threat surface. Organizations that delay applying emergency patches to these appliances risk complete perimeter compromise, potentially granting attackers a foothold into the entire internal network. This incident underscores how unpatched network security appliances are among the highest-value targets for threat actors, as a single exploit can bypass all downstream defenses.",[151,152,153,154,155,156,157],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","CIS Control 12: Network Infrastructure Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":159,"NIST SP 800-53 SI-2: Flaw Remediation":160,"CIS Control 12: Network Infrastructure Management":161,"OWASP A06:2021 Vulnerable and Outdated Components":162,"CIS Control 7: Continuous Vulnerability Management":163,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":164,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":165},"NIS2 requires essential and important entities to implement incident handling and vulnerability management measures, including rapid response to critical security flaws in network security products such as these VPN gateways.","SI-2 requires organizations to identify, report, and correct information system flaws promptly; applying Check Point's emergency patches in a defined timeframe directly fulfills this control and would have closed the attack vector.","Proper network segmentation of VPN gateways into a DMZ, as required by this control, would have limited the blast radius of a successful exploit by preventing direct lateral movement into the internal network.","The affected Check Point products represent exactly the class of risk OWASP A06 addresses — unpatched, vulnerable components in critical infrastructure that attackers can exploit with publicly known techniques.","Regular vulnerability scanning and a structured patching cadence would have ensured these CVSS 9.8 flaws were identified and remediated on an emergency timeline before exploitation could occur.","This control mandates timely identification and remediation of technical vulnerabilities in internet-facing systems, which would have driven urgent patching of the affected Check Point appliances upon disclosure.","These vulnerabilities allow unauthenticated remote code execution, highlighting the need for controls that enforce strong authentication boundaries on network access points and detect attempts to bypass them."]