An ASN.1 heap overflow puts Check Point management servers in the same patch window as the gateways

Both flaws sit in the part of the handshake that runs before anyone has proved who they are. The write-up cites BleepingComputer, the Dutch NCSC and Check Point. It gives the sequence: the attacker reaches a vulnerable Remote Access or Site-to-Site VPN over the network, then sends specially crafted certificate data during negotiation ^[4]. Parsing that certificate is how the device decides whether to trust the peer, so the parser runs on bytes from a party that has authenticated nothing. In CVE-2026-85103 the parse is an ASN.1 decode and the bug is a heap overflow ^[3]. I treat any ASN.1 decoder on an internet-facing box as attacker-reachable by default.

The scoping problem is the Security Management Server. It is in the affected list for CVE-2026-85103, and the write-up does not say how it is reached or on which ports ^[3][6]. It also says not to exclude the management server on the grounds that VPN UDP/500 and UDP/4500 are unexposed ^[6], and an asset list built from IKE firewall rules will not have it. Security Gateway and Spark Firewall appear in both CVEs; the management server appears only in the ASN.1 one ^[15].

What follows a successful hit on the management server, the write-up marks as inference: impact could spread to the settings and credentials of managed gateways ^[7]. It flags the gateway case the same way, saying an attacker with code execution could use gateway privileges and network reachability to change settings, steal information and carry out further activity inside the internal network ^[16].

Detection expectations are modest. Because the attack needs no click and no login, ordinary users may notice nothing ^[8]. The administrator-side signals in the write-up are also labelled inference: anomalies in VPN negotiation or certificate parsing, crashes and restarts of the related processes, and UDP/500 and UDP/4500 traffic from unknown sources ^[9].

How much work this is depends on the version list: R81.20, R82, R82.10, R81.10.x, R82.00.x, and the end-of-life R80 through R81.10, in each case without the required patches applied ^[10]. Permanent fixes come as Jumbo Hotfix Accumulator levels, listed in the write-up for R82.10, R82 and R81.20 ^[11]. Check Point's sk185114 covers LivePatch support configuration and application status, and the per-CVE advisories are sk1000117 and sk1000118 ^[12][18]. For an estate still on an end-of-life train, the work is a version upgrade.

The Dutch NCSC's position, in a write-up dated 12 September 2026, is a forecast. It assesses exploitability and impact as high and predicts that large-scale exploitation attempts will begin soon, and no specific example of active exploitation appears in the referenced material ^[5][14]. In my view that is enough to move the window forward, because the vulnerable parse sits on the pre-authentication path of a device whose job is to be reachable. The write-up maps the technique to MITRE ATT&CK T1190 ^[13].