Check Point Fixes Two Critical VPN Flaws That Could Let Hackers In Without a Password

Key points

• Check Point patched two critical flaws in its firewall and management products, each rated 9.8 out of 10 on the industry severity scale.
• Both bugs sit in the way the products handle VPN certificates, the digital ID cards that prove a remote worker is who they say they are.
• A remote attacker could run their own code on the device without logging in, but only "under specific conditions" the company hasn't spelled out.
• One flaw hits Security Gateways, the firewall boxes sold to businesses; the other hits both the gateways and the Security Management Server that controls them.
• No active exploitation has been reported, but customers are told to install the fixes now.

Check Point, one of the largest firewall makers in the world, has quietly pushed out fixes for two serious bugs in its VPN software.

A VPN, short for virtual private network, is the encrypted tunnel that lets an employee at a coffee shop reach files on the office network. The firewall on the other end checks a certificate, a small cryptographic file that acts like a staff pass, before letting the connection through. Both flaws live in exactly that check.

What did Check Point actually fix?

Two vulnerabilities in how its products validate VPN certificates, each scored 9.8 out of 10 on the industry severity scale.

The first flaw affects Check Point's Security Gateways, the physical or virtual firewall appliances that sit at the edge of a company network and decide what traffic is allowed in. The second affects both those gateways and the Security Management Server, the central console administrators use to configure a fleet of firewalls at once. An attacker who took over the management server would effectively hold the keys to every firewall it controls.

Check Point says both bugs could let an unauthenticated remote attacker, someone on the internet with no account and no password, run code of their choosing on the device. That only works "under specific conditions" the vendor hasn't described publicly, presumably to slow anyone building a working exploit.

How bad is this in plain terms?

Bad enough that every Check Point customer should patch this week. A firewall is the front door of a corporate network, and a bug that lets a stranger run code on it without a login prompt is exactly what ransomware crews and state-backed groups hunt for.

Edge devices have been a favourite target for years. We covered a perfect-score Cisco firewall bug already under active attack on 9 September, and before that a Citrix login-bypass rated 9.3 where researchers called exploitation a matter of when, not if. The pattern is consistent: disclosure is followed by exploitation within days.

Check Point says it has no evidence anyone is exploiting these flaws yet. That window won't stay open.

Would multi-factor authentication have helped?

No. Multi-factor authentication, the extra code from a phone or hardware key, protects the login step. These bugs skip it entirely by abusing the certificate check that happens before a user is ever identified. It's a protocol-level flaw in certificate validation, not a stolen-password problem. The only fix is the vendor patch.

What should administrators do now?

Install the Check Point hotfixes on every affected gateway and management server. Then check the logs for unusual VPN certificate errors or unexpected administrator sessions over the past few weeks, in case anyone got in early.

Ordinary end users, the staff who click a VPN icon each morning, don't need to do anything. This one's on the IT team.