Check Point patches two 9.8 VPN certificate flaws without naming what triggers them

The exposure question turns on one reply in the customer thread. Asked whether gateways with the VPN software blade switched off are affected by CVE-2026-85103, a Check Point staff member said the issue is certificate processing, so it could in theory be triggered in an environment with no VPN but with VPN certificates present ^[10]. Read that against the advisory from the Canadian Centre for Cyber Security, published the same evening, which names Security Gateway, Security Management Server and the Spark small-business line with no version data at all, and which names Spark twice, once for deployments using Site-to-Site or Remote Access VPN and once with no such condition ^[9].

Check Point has not said what the specific conditions are ^[2]. The reachable set is therefore unknown to the customer, and the score does not narrow it. What is on offer instead is a version list: R82.10 at Jumbo Hotfix Take 43 or below, R82 at Take 125 or below, R81.20 at Take 165 or below, marked as affected rather than fixed, covering three Quantum branches with no version information for anything else ^[8].

Check Point says Live Patch users are protected automatically as the rollout begins, and an employee said it installs on top of any Jumbo Hotfix level in R81.20, R82.00 and R82.10 ^[11]. Five accounts said it had not reached them, reporting gateways still on Take 18 or Take 17 of the urgent security update package on the day of the announcement, one with an update log showing Take 18 installed on September 1 and nothing since ^[15]. Several customers also said the advisory download links failed for them; a staff member replied that the links had been checked and were working; one customer then reported the advisory links still failing in two browsers while the link in the Live Patch article worked ^[16]. Automatic protection is verifiable only at the take level on the gateway.

R81.10 has no route. Two customers said they are on that branch and will not be moving off it for weeks, and one said neither a Jumbo Hotfix nor a Live Patch existed for it, leaving mitigation as the only option ^[13]. The mitigation is turning off implied rules for VPN. One customer called that too vague to act on and asked which configuration lines to comment out; another asked how to apply it without affecting remote users; neither got an answer in the thread ^[14].

The June and July flaws in these same products were being exploited when Check Point announced them ^[17]. June's, CVE-2026-50751, was an authentication bypass in Remote Access VPN and Mobile Access certificate validation, and CISA added it to the Known Exploited Vulnerabilities catalog on June 8 ^[18]. July's, CVE-2026-16232, was a SmartConsole authentication bypass, and it went into the same catalog ^[19]. Counting this week's pair, that is four criticals in the line since June, two of them exploited before the vendor spoke ^[21], with 93 days between the June KEV entry and this disclosure ^[20]. This time the fix exists ahead of the attack traffic, which helps only on the gateways whose take level actually moves.