Dutch NCSC warns Check Point VPN exploitation imminent

In a warning dated September 12, the Dutch National Cyber Security Centre (NCSC) said two critical vulnerabilities in Check Point VPN are likely to be exploited very soon, and it is urging organizations to install the vendor's security updates from September 9 without delay. The flaws are tracked as CVE-2026-85102 and CVE-2026-85103. Although no public proof-of-concept exploit has been reported, the agency assesses the likelihood of exploitation and the potential impact as high, and it expects exploitation attempts to occur soon.

Check Point VPN is an enterprise remote-access solution that lets employees connect securely to a company's internal network through encrypted tunnels. According to Check Point's advisories sk1000117 and sk1000118, the first flaw, CVE-2026-85102, is an improper validation of certificate data during VPN negotiation. A remote attacker could exploit it to execute arbitrary code on a Security Gateway, which is the network device that terminates VPN connections. The second flaw, CVE-2026-85103, is a heap overflow in the VPN certificate ASN.1 decoder. ASN.1 is a standard syntax used to represent certificate data, and a heap overflow means the decoder writes past the memory area it was allocated, which can corrupt memory and lead to remote code execution on both Security Gateways and Security Management Servers.

The affected releases include R81.20, R82, R82.10, R81.10.x, and R82.00.x, as well as the end-of-support versions R80 through R80.40, R81, and R81.10. Check Point fixed the flaws with LivePatch Take 24 for R81.20, R82, and R82.10. The fixes are also included in R82.10 Jumbo Hotfix Accumulator Take 44 or later, R82 Jumbo Hotfix Accumulator Take 126 or later, R81.20 Jumbo Hotfix Accumulator Take 166 or later, Spark R82.00.10 Build 2325 or later, and Spark R81.10.17 Build 4968 or later. Check Point VPN version R82.20 is not affected by either vulnerability.

The NCSC warns that successful exploitation of the two flaws could allow an attacker to take full control of a system, view or modify confidential data, and disrupt operations. System administrators should apply the updates as soon as possible. For organizations using the Site-to-Site VPN component, the agency also advises modifying VPN rules to limit access to specific, trusted IP addresses. In a Check Point community forum post, users of Check Point Live Patch (CPLP) were told they should have received all available protections for the two flaws since September 9, and those fixes should apply even without a server reboot. CPLP users should still check whether they are protected, because the automatic mitigation is not available for versions other than R82.10, R82, and R81.20 and does not support all configurations.

For website owners, hosting providers, and IT teams, the warning is a reminder that remote-access infrastructure is a prime target. Because Check Point VPN is used to reach internal networks, an unpatched gateway can become the entry point for attackers to move deeper into a company's systems and data. The absence of a public exploit today does not lower the urgency when a national security agency says exploitation is imminent. Applying the vendor patch, or the recommended LivePatch or hotfix, closes the known code execution paths before attackers can use them. For businesses that want help reviewing their update and access-control processes, AEU-I provides security-first IT and infrastructure consulting.