Check Point Issues Fixes for Critical VPN Certificate Flaws Allowing Remote Code Execution

TELVIV — Check Point Software Technologies disclosed two critical vulnerabilities in its VPN certificate handling on Wednesday, September 10, 2026, and immediately began distributing security patches to address the flaws. The defects, found within the company's firewall and management products, could allow unauthenticated remote attackers to execute arbitrary code under specific conditions without requiring prior access or credentials.

The vulnerabilities stem from improper validation of certificates used in VPN connections. Security researchers detailed how an attacker could craft a malicious certificate that, when processed by affected systems, triggers a buffer overflow or similar memory corruption error. This mechanism enables the execution of remote code with high privileges, potentially granting full control over the compromised network infrastructure. Because the exploitation does not require authentication, the flaws pose a significant risk to organizations relying on Check Point's security gateways for perimeter defense.

Check Point announced the discovery and the availability of fixes in a coordinated disclosure statement released at 12:06 UTC. The company urged all customers running affected versions of its Security Gateway and Management Server software to apply the updates immediately. The vendor stated that the patches address the root cause of the certificate parsing errors and have been tested across various deployment configurations.

The affected products include several generations of Check Point's security appliances and virtual instances widely deployed in enterprise environments globally. While the company did not specify which exact software versions are vulnerable in its initial public statement, it confirmed that the issue impacts systems utilizing specific VPN protocols where certificate validation is performed. Administrators were advised to review their patch levels and verify that the latest hotfixes have been installed.

No active exploitation of these flaws in the wild has been confirmed by Check Point as of Wednesday afternoon. However, security experts warn that the nature of unauthenticated remote code execution vulnerabilities often leads to rapid weaponization once details become public. The disclosure comes amid a broader industry trend of attackers targeting network perimeter devices to establish footholds within corporate networks.

The company is working with customers to ensure widespread adoption of the patches and has activated its incident response teams to assist organizations facing potential compromise. Check Point also emphasized that the vulnerabilities do not affect all configurations equally, noting that specific security policies or hardware models might mitigate the risk even before patching. However, the vendor maintains that applying the official fix is the only guaranteed method to eliminate the threat.

As of Wednesday evening, it remains unclear how long the vulnerabilities existed prior to discovery or if any unauthorized access has already occurred using these methods. Check Point indicated it would provide further details on the technical specifics of the flaws and a comprehensive list of affected versions in an upcoming security advisory bulletin.