Why Live Patching Perimeter Appliances Covers Less Than It Seems

When Check Point disclosed two CVSS 9.8 VPN vulnerabilities in September 2026, its first line of defence was not a hotfixHotfix🛡️An out-of-cycle software update that addresses a specific urgent defect, usually a security flaw, on an existing release line without waiting for the next scheduled version. Hotfixes are typically numbered and cumulative on that line, but each covers only the issues named in its notes, so a later one may be required. package but LivePatch: a fix pushed automatically to supported gateways starting the day of disclosure, applied without a reboot. Several appliance vendors now offer something similar. It is a genuine improvement over the old cycle of advisory, download, maintenance window, reboot. It is also easy to misunderstand, and organisations that treat a hot patch as the end of the job tend to discover the gap later. This article lays out what live patchingLive Patching🛡️Applying a security fix to running software on an appliance or server without a full upgrade or reboot, often delivered automatically by the vendor. It shortens the exposure window but typically covers only supported releases and does not replace the full fixed release. on a perimeter appliance actually does, where its coverage ends, and how to plan around it.

What a hot patch is

A live patch, hot patch, or in-memory patch modifies the running code of an appliance without a full software upgrade and usually without a restart. The exact mechanism varies. Some vendors replace individual shared libraries and restart only the affected daemon. Some inject a corrected function into a running process. Some ship a small package that the appliance fetches and applies on a schedule. The common threadThread🏠A low-power mesh networking protocol designed for IoT devices, used alongside Matter. is speed: the fix reaches the device hours after disclosure rather than days or weeks, and the operational cost of applying it is close to zero.

For an edge deviceEdge Device🌐A network appliance that sits on the boundary between the internet and an internal network, such as a VPN gateway, firewall, or secure-access appliance. Edge devices are internet-facing, hold credentials, and broker connections inward, which makes them high-value and frequently repeated targets for zero-day exploitation. that is reachable from the whole internet, that speed matters. The interval between a patch being published and a working exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. appearing has collapsed to days for high-profile products, and the CVE-2026-85102 and CVE-2026-85103 timeline shows why: the vendor released fixes on 9 September, a national CERT warned of imminent large-scale exploitation on 10 September, and the KEV catalog had not yet caught up when the trade press covered it on 12 September. A fix that lands automatically inside that window is worth having.

Where the coverage ends

Live patching narrows the exposure window; it does not eliminate the work. Four gaps recur.

It only covers supported releases

Check Point's LivePatch bundle for these CVEs targeted R82.10, R82, and R81.20. Everything from R80 through R81.10 was listed as affected, end of support, and not receiving a fix. That pattern is universal: hot patching is a feature of current releases, and the devices most likely to be running old code are exactly the ones that will not get it. A live-patch programme therefore depends on an inventory that tells you which appliances are outside its reach, and an upgrade plan for them.

It is not always enabled, and it is not always confirmed

Automatic patching requires the appliance to reach the vendor's update service and to have the feature turned on. Devices in isolated networks, behind egress filteringEgress Filtering🌐Restricting the outbound connections a system may make to an explicit list of required destinations, enforced at the network layer or through an egress proxy. It breaks payload downloads, mining-pool connections and callback channels, and turns an attacker's success signal into a detection event., or with the feature disabled during a previous change will silently miss the rollout. The Check Point advisory tells administrators to verify with a specific command rather than assume; that instruction exists because assumption is the failure mode. Whatever your platform, the operational step is the same: after a critical hot patch, produce a list of every appliance and its confirmed patch state, and chase the ones that do not report the fix.

It is a stopgap for the real package

Vendors typically ship the hot patch alongside a conventional fixed release (Check Point's Jumbo Hotfix Accumulator takes, in this case). The hot patch is designed to close the specific hole quickly; the full package carries the same fix plus everything else in the release, and it is what the next hot patch will assume as a baseline. Running indefinitely on a hot-patched older take leaves you dependent on the vendor continuing to build hot patches for that exact combination. Schedule the full package into the next maintenance window even when the hot patch is confirmed.

It does not undo a compromise

If a gateway was exploited before the fix arrived, patching it in memory stops the next exploitation attempt and does nothing about the first. An attacker who achieved code execution on a VPN appliance may have installed persistence, harvested credentials and certificates, or moved to the management server. The question "was this device reached before the patch?" has to be asked separately, and if the answer is yes or unknown, the response is the process described in the site's guide on rebuilding a compromised VPN appliance, not a patch.

Planning around it

A workable approach for a perimeter fleet looks like this.

1. Inventory every internet-facing appliance with its exact release and take or build. This list is the input to everything else. Include management servers; CVE-2026-85103 reaches them.
2. Classify each device as live-patchable, patchable only by package, or unpatchable (end of support). The third category gets an upgrade date, not a mitigation.
3. For live-patchable devices, confirm the feature is enabled and the device can reach the update service. Test this before you need it, with a low-stakes update.
4. Define the verification step. After a critical rollout, someone owns producing the confirmed-patched list within a fixed time, say 24 hours, and escalating exceptions.
5. Treat the full fixed release as mandatory follow-up with a deadline, typically the next maintenance window.
6. Pair patching with exposure reduction. The site-to-site peer pinning described in how to lock down IKE and IPsecIPsec🌐A suite of protocols that authenticates and encrypts IP traffic at the network layer, used for site-to-site tunnels between gateways and for many remote-access VPNs. IKE handles the negotiation; ESP carries the protected packets. ports to known VPN peers shrinks the attacker population regardless of patch state and costs nothing to keep in place.
7. Decide in advance what evidence would make you treat a device as compromised rather than merely vulnerable, so the decision is not made under pressure.

A note on trust

Automatic in-memory patching means the vendor can change what your perimeter firewallFirewall🌐Security system that monitors and controls network traffic based on predetermined rules. executes, at a time of its choosing, without a human in your organisation approving the specific change. For most organisations that is an acceptable trade given the alternative, but it should be a conscious decision. Know how the update channel is authenticated, know what the appliance logs when a hot patch applies, and make sure that log reaches your SIEM. The same channel that delivers the fix for a pre-authentication certificate-parsing bug (see why VPN certificate parsing is pre-authentication attack surfaceAttack Surface🛡️The sum of all points where an unauthorized user could attempt to enter or extract data from a system: exposed services, interfaces, accounts, and integrations. Reducing attack surface means removing reachability, not just patching. for what that class of bug looks like) is itself a privileged path into the device, and it deserves the same scrutiny as any other management-plane access.

Live patching is the right default for perimeter appliances. Just do not let it become the reason the inventory is stale, the end-of-support gateway is still online, or nobody checked whether the fix actually landed.