What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
No public, reproducible internet-wide count of Check Point systems exposed to CVE-2026-85102 or CVE-2026-85103 has been published. Check Point’s advisory, CERT-EU’s advisory and the NVD record describe the flaws, affected products and observed attacks. None of them measures how many devices are reachable and unpatched. This article explains what is established, why a headline scan number would be hard to trust, and how to check your own estate.
What is established about the two flaws
The two CVEs are separate bugs in VPN certificate handling. They have different code paths, different affected roles and different evidence of exploitation. Treating them as one problem leads to wrong conclusions about who is at risk.
As an Amazon Associate I earn from qualifying purchases.
| Comparison axis | CVE-2026-85102 | CVE-2026-85103 |
|---|---|---|
| Flaw | Improper validation of certificate data during VPN negotiation | Heap overflow in ASN.1 decoding of VPN certificates |
| Impact (per CERT-EU) | Unauthenticated remote code execution | Heap overflow; CERT-EU’s summary does not describe the same outcome |
| Affected role | Security Gateway (including Spark contexts) | Security Gateway and Security Management Server |
| Configuration precondition | Remote Access VPN or Site-to-Site VPN in use | Not stated in the CERT-EU summary; check the vendor advisory |
| CVSS | 9.8 per CERT-EU; the Check Point CNA score of 9.8 (CVSS 3.1) is shown on NVD | 9.8 per CERT-EU |
| Exploitation evidence | Check Point reports a wave of attempts against Spark customers | No vendor exploitation statement was found for this CVE |
NVD’s CVE-2026-85102 entry was marked “Awaiting Enrichment” when retrieved. The 9.8 it shows is the CNA’s own score, not an independent NIST assessment. The entry also lists specific Gateway Jumbo Hotfix thresholds. Use those thresholds, and Check Point’s advisories, to decide whether a given build is affected.
The management-server scope of CVE-2026-85103 does not carry over to CVE-2026-85102’s exploitation reports. Check Point’s statements about attacks concern CVE-2026-85102 and Spark customers.
#1 Best Overall
Timeline
- September 9, 2026: Check Point released fixes for CVE-2026-85102, according to its later advisory. NVD gives the same date as the record’s publication date.
- September 12, 2026: Check Point says it began observing a wave of exploitation attempts against Spark customers.
- September 22, 2026: Check Point published an advisory by Lotem Finkelstein, VP Research, describing the activity and its recommendations.
The gap between the fix and the first observed attacks is three days. The advisory describes attempts, not confirmed compromises, and not a number of victims.
Why there is no trustworthy exposure number yet
The Shodan CVE page for these flaws shows vulnerability metadata and product information. It gives no attributable asset count and no stated scan methodology. A vendor incident write-up and a CVE dashboard are not census data. Quoting an “exposed devices” figure from either would invent a measurement.
What an outside scan can plausibly see
- Whether a host answers as a Check Point VPN or portal service, based on banners, certificates or protocol behaviour.
- Whether that service is reachable from the internet at all, as opposed to being limited to internal networks.
What it generally cannot see
- The exact build or Jumbo Hotfix take. Exposure depends on version thresholds, and a product banner does not tell you whether a hotfix is installed.
- Whether the vulnerable feature is enabled. CVE-2026-85102 applies to deployments using Remote Access VPN or Site-to-Site VPN. A device that answers on the internet is not necessarily in that configuration.
- Whether the management server is reachable. Security Management Server is in scope for CVE-2026-85103, yet management servers are often deliberately not internet-facing. Perimeter scans would not count them.
- Safe exploit verification. Confirming a memory-corruption or certificate-validation bug on someone else’s gateway would mean sending hostile input. Responsible public scanners usually avoid this, so any count is an inference rather than a confirmed vulnerability.
How to judge any scan figure you encounter
If a researcher or vendor publishes a count, check these points before repeating it:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute- Observation date. Patching changes the number quickly, and a figure from before September 9 says little about the present.
- Scanner and identification method.
- Whether it counts raw banners or validated vulnerable builds.
- Deduplication of hosts that appear on several IPs or ports.
- Geographic and network coverage.
- Whether it covers Spark appliances, Quantum-class gateways, or both.
A number that omits these details is a banner count at best.
The anecdotal reports
A user on Check Point’s CheckMates community described suspicious certificate-based Remote Access VPN sessions followed by LDAP/LDAPS scanning in two customer environments before patching. This is a single community post. It is not a vendor-confirmed case series and says nothing about prevalence. The poster also asks whether something else could explain the activity.
Rank #3
- Used Book in Good Condition
What to do if you run Check Point gateways
- Inventory. List every Security Gateway, Spark appliance and Security Management Server, with its release and installed Jumbo Hotfix take or build.
- Check configuration. Note which gateways have Remote Access VPN, Mobile Access or Site-to-Site VPN enabled. These are the preconditions for CVE-2026-85102.
- Match against the advisory. Use Check Point’s product-specific security advisories and the NVD hotfix thresholds for your exact release. Do not assume that a device is either affected or protected.
- Patch internet-facing gear first. CERT-EU strongly recommends applying available hotfixes immediately and prioritizing internet-facing perimeter appliances. The vendor advisory points to the product pages for remediation steps, validation commands, mitigations and upgrade guidance.
- Don’t forget management servers. CVE-2026-85103 covers Security Management Server as well as gateways.
Hunting for signs of attempted exploitation
Check Point recommends reviewing logs for anomalous certificate-based Mobile Access logins, then looking for follow-on activity from any suspicious logged-in user, including internal port and service scanning.
The vendor observed attempts using certificates with these subjects:
Free tools Windows power users keep installed
One-click scans. No signup required.
CN=vpn,OU=users,O=globalCN=vpn-user,OU=users,O=globalCN=vpnuser,OU=users,O=global
Check Point says this list is incomplete, so don’t limit your searches to these strings. Treat these as hunting leads. A match is not proof of compromise, and no match does not clear a system. Logins that succeed and are followed by scans of internal services deserve the closest look, because that pattern is what the vendor described.
Quick Recap
Best Value
- Used Book in Good Condition
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
