Build1 publisher2 min readPublished
Check Point ships this week's VPN fix as a live patch for three versions and an upgrade for the rest
Two unauthenticated Check Point RCEs, a CVSS 10.0 GitLab path traversal and an already-exploited N-able flaw all came due on September 11. How fast each one closes depends on the release you happen to be running.
The Engineer · Build desk
What happened
- Check Point published patches on September 11 for two remote code execution flaws in its VPN appliances, CVE-2026-85102 in the Security Gateway and CVE-2026-85103 reaching the Management Server.
- GitLab shipped fixes the same day for CVE-2026-85706, a CVSS 10.0 path traversal in the commits API that reads files from the server without authentication.
- CISA listed N-able N-central's pre-auth RCE, CVE-2026-86218, in its known-exploited vulnerabilities catalog with a remediation deadline of September 11.
- watchTowr detected probes in production against the GitLab flaw within hours of its public disclosure.
- The week before, GreyNoise and SecurityWeek documented hundreds of AI agents chaining two PaperCut NG/MF flaws to compromise around 440 organizations across 48 countries.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- precedent A catalog entry with a one-day remediation deadline tells every operator bound by that catalog that same-day is the standard for an exploited edge appliance.
- capability A Codex harness driving a DeepSeek model runs exploit development and validation without a human team behind it. That widens the set of actors who can act on a fresh advisory the day it lands.
- exposure One education center went from initial access to Domain Admin in seven minutes. That sets the containment budget for an exposed edge box in minutes of detection time, not days of patch cycle.
- contradiction The post's own remedy sits awkwardly with its framing: it argues patching in hours is now the minimum, then names segmentation and egress filtering as the controls that decide the outcome. Both of those work independently of patch speed.
Check Point's LivePatch Take 24 covers R81.20, R82 and R82.10, and every other version has to move to R82.20 [5]. Those are two different jobs. A live patch is a maintenance action on a running gateway. Going to R82.20 is a change request with a rollback plan, on the box that terminates remote-access sessions for the whole site [1]. The Dutch NCSC warned of imminent exploitation [4].
The advisory pairs the patch with a control that does not depend on the version: restrict ports 500, 4500 and 443 to authorized peers only [6]. Site-to-site tunnels already have that peer list. A remote-access population arriving on 443 from arbitrary networks does not, and on those gateways the upgrade is the only path to the fix.
Fixes for the GitLab traversal shipped in 19.3.2, 19.2.6 and 19.1.8 [9]. Three release lines got the backport, so a self-managed operator on 19.1 can take a patch release instead of a minor upgrade. The post does not report a confirmed read through CVE-2026-85706; what watchTowr recorded was probing [10].
All three flaws work without credentials [2] [8] [11] [1]. Shadowserver counted close to 1,500 exposed N-central consoles [14], and the catalog's remediation deadline for that flaw fell on the same day Check Point and GitLab published their fixes [2]. An administrator running all three products had one day and three different fix paths.
GreyNoise and SecurityWeek documented hundreds of AI agents chaining CVE-2026-81578 and CVE-2026-82078 against PaperCut NG/MF servers on a Codex harness with a DeepSeek model [15] [16]. Almost half of the organisations compromised in that campaign were in education [18]. "I have the feeling that we are losing control on defense ever since agents burst onto the scene," the post's author wrote [22].
The claim underneath is about cost: the post holds that finding, testing and deploying an exploit got cheap enough to run in parallel [20]. All of it comes through one dev.to write-up, which credits SecurityWeek, The Hacker News, watchTowr, GreyNoise and Shadowserver for the underlying reporting [23].
What to watch
- Whether Shadowserver's count of exposed N-central consoles falls after the September 11 remediation deadline.
- Whether Check Point or the Dutch NCSC reports exploitation of CVE-2026-85102 or CVE-2026-85103 in the wild.
- Whether anyone publishes a confirmed file read through the GitLab commits API flaw, beyond the scanning.