Check Point patches two 9.8 VPN certificate flaws without naming what triggers them

Check Point has patched two critical vulnerabilities in the way its firewall and management products handle VPN certificates.

Check Point disclosed the flaws on September 9 in a notice to its customer community and began delivering fixes the same day.

Check Point says it found both flaws itself and has no indication that either has been used in an attack.

In June and July, Check Point patched critical flaws in these products that it said were already being exploited when it announced them.

Both CVE records carry a CVSS score of 9.8, and Check Point assigned the identifiers and the scores itself.

June's flaw was CVE-2026-50751, an authentication bypass in Remote Access VPN and Mobile Access certificate validation, which CISA added to its Known Exploited Vulnerabilities catalog on June 8.

July's flaw was CVE-2026-16232, a SmartConsole authentication bypass, which CISA added to the same Known Exploited Vulnerabilities catalog.

Both records give the same affected list: R82.10 with Jumbo Hotfix Take 43 or below, R82 with Take 125 or below, and R81.20 with Take 165 or below. Those are the versions marked affected, not the versions containing the fix, and the list covers three Quantum branches with no version information for anything else.

An advisory from the Canadian Centre for Cyber Security, published the same evening, lists Security Gateway, Security Management Server and Spark Firewall, Check Point's small-business line, with no versions at all; Spark appears twice, once for deployments using Site-to-Site or Remote Access VPN and once without that condition.

Check Point says customers using Check Point Live Patch are protected automatically as the rollout begins, which started September 9; a Check Point employee said in the thread that it can be installed on top of any Jumbo Hotfix level in R81.20, R82.00 and R82.10, naming only those three versions.

The second route to the fix is the Jumbo Hotfix; Check Point told customers to install the latest one for their deployed version once available.

Two customers said in the thread that they are running R81.10 and will not be moving off it for weeks; one said no Jumbo Hotfix and no Live Patch was available for that branch, leaving mitigation as the only option.

One customer described the advisory's mitigation as turning off implied rules for VPN, called it too vague to act on and asked which configuration lines to comment out; another asked how to apply the mitigation without affecting remote users. Neither question had an answer in the thread.

Four critical flaws have been disclosed in these Check Point products since June (CVE-2026-50751, CVE-2026-16232, CVE-2026-85102, CVE-2026-85103), two of which were already being exploited when announced.

Asked in the community thread whether gateways with the VPN software blade turned off are affected by CVE-2026-85103, a Check Point staff member replied that the issue is about certificate processing, so it could in theory be triggered in an environment without a VPN but with VPN certificates present.

Five separate accounts reported that gateways were still on Take 18 or Take 17 of the urgent security update package on the day of the announcement; one posted an update log showing Take 18 installed on September 1 and nothing since.

Several customers reported that download links in the two advisories did not work for them; a Check Point staff member replied that the links had been checked and were working; one customer said afterward that the advisory links still failed in two browsers while the link in the Live Patch article worked.

93 days elapsed between CISA adding CVE-2026-50751 to the KEV catalog on June 8 and Check Point's September 9 disclosure of the two certificate flaws.