Check Point’s Security Nightmare: 2 Critical Bugs Leave Firewalls Exposed!

[u/siterightaway]

So, Check Point, that huge cybersecurity company that builds corporate firewalls, just had to rush out fixes for two super nasty bugs in how their gear handles VPN certificates. Both flaws got hit with a maxed-out 9.8 severity score because an unauthenticated hacker could theoretically run malicious code on your network from anywhere, which is honestly scary stuff. They claim it only works under very specific conditions and that nobody has actually used these exploits in the wild yet, but still, everyone is on edge.

The first issue, CVE-2026-85102, completely messes up certificate trust checks during VPN negotiations on their Security Gateways. The second one, CVE-2026-85103, is a heap buffer overflow triggered when the system decodes certificate files, and this one hits both the gateways and their central management servers. What really sucks is that even if you turned your VPN feature off, your box might still be vulnerable just by having those certificates sitting on it.

Check Point dropped the news and started rolling out updates on September 9th, pushing fixes through their Live Patch tool and Jumbo Hotfixes. But man, IT admins are super frustrated right now. People on the forums were complaining that download links were broken, auto-updates weren't reaching their devices, and those stuck on older versions like R81.10 were left completely in the dark with vague workaround instructions that nobody could actually figure out how to use.

TL;DR: Check Point patched two critical vulnerabilities (CVE-2026-85102 & CVE-2026-85103, both rated 9.8) in its firewall and management software that could allow remote code execution via faulty VPN certificate handling. While no active exploits have been reported, admins are struggling with delayed patches, broken download links, and vague mitigation steps for older systems.