The Dutch Nationaal Cyber Security Centrum (NCSC) has issued a warning regarding the imminent exploitation of two critical vulnerabilities in Check Point VPN products, identified as CVE-2026-85102 and CVE-2026-85103. The agency has assessed the likelihood of exploitation and the potential impact as high, urging organizations to apply security updates promptly.
Check Point, an enterprise VPN solution provider, released fixes for these vulnerabilities on September 9, accompanied by security advisories sk1000117 and sk1000118. While no public proof-of-concept exploits have been reported, the NCSC anticipates exploitation attempts will begin soon.
CVE-2026-85102 is described as an improper validation of certificate data during the VPN negotiation process. This flaw could allow a remote attacker to execute arbitrary code on a Security Gateway. CVE-2026-85103 is a heap overflow vulnerability found in the VPN certificate ASN.1 decoder, which could also lead to remote code execution on both Security Gateways and Security Management Servers.
The affected Check Point releases include R81.20, R82, R82.10, R81.10.x, and R82.00.x. Additionally, end-of-support (EoS) versions such as R80 through R80.40, R81, and R81.10 are also vulnerable. Check Point VPN version R82.20 is confirmed not to be affected by either flaw.
Patches for these vulnerabilities are included in Check Point LivePatch Take 24 for R81.20, R82, and R82.10. Further fixes are integrated into specific Jumbo Hotfix Accumulator versions: R82.10 Jumbo Hotfix Accumulator Take 44 or later, R82 Jumbo Hotfix Accumulator Take 126 or later, and R81.20 Jumbo Hotfix Accumulator Take 166 or later. Additionally, Spark R82.00.10 Build 2325 or later and Spark R81.10.17 Build 4968 or later also contain the necessary remediations.
The NCSC has highlighted that successful exploitation of these flaws could grant an attacker full control over a system, enable access to or modification of confidential data, and disrupt operations. System administrators are strongly advised to apply the security updates as quickly as possible.
For organizations utilizing the Site-to-Site VPN component, the NCSC recommends an additional measure: modifying VPN rules to restrict access to only specific, trusted IP addresses.
According to information shared in Check Point's community forums, users of Check Point Live Patch (CPLP) should have received all available protections for these two vulnerabilities since September 9. These fixes are designed to apply automatically, often without requiring a server reboot. However, CPLP users are advised to verify that these automatic mitigations have been successfully applied, as they are not available for all configurations or for versions other than R82.10, R82, and R81.20.
