Critical Check Point VPN Vulnerabilities Expose Networks to Remote Attacks
Dutch NCSC warns of two 9.8 CVSS-rated flaws enabling system takeovers - patch immediately.
1Critical VPN Flaws Discovered
The Dutch National Cyber Security Centre (NCSC) has issued an urgent warning about two critical vulnerabilities in Check Point VPN products, both scoring 9.8 on the CVSS scale. These flaws, identified as CVE‑2026‑85102 and CVE‑2026‑85103, could allow unauthenticated attackers to execute remote code on affected systems. The NCSC assesses both the likelihood of exploitation and potential damage as high, expecting active attacks to begin soon.
2Technical Details of Vulnerabilities
CVE‑2026‑85102 resides in the VPN negotiation process, allowing attackers to bypass security checks and run arbitrary code on the gateway. CVE‑2026‑85103 is a heap overflow vulnerability in the certificate ASN.1 decoder that similarly enables remote code execution. Both can be triggered externally, potentially giving attackers full system control to read/modify data or disrupt operations. No public proof-of-concept exists yet, but the risk is imminent.
3Affected Software Versions
The vulnerabilities impact Check Point releases R81.20, R82, R82.10, R81.10.x and R82.00.x, plus end-of-support versions from R80 through R81.10. Only R82.20 remains unaffected. Check Point released patches on September 9 via advisories sk1000117 and sk1000118. The company provides fixes through LivePatch Take 24 or specific Jumbo Hotfix updates, depending on the version in use.
4Patch Implementation Guidance
For systems running R81.20, R82 or R82.10 with LivePatch, protection may already be in place without requiring a reboot. However, organizations must verify their specific configurations as LivePatch doesn't cover all scenarios. The NCSC strongly recommends applying updates immediately rather than waiting for scheduled maintenance windows, given the critical nature of these vulnerabilities.
5Additional Security Measures
Beyond patching, the NCSC advises organizations using Site-to-Site VPN to tighten their rulesets: disable implied rules and restrict VPN access to specific, trusted IP addresses. These measures reduce the attack surface while patches are being deployed. Organizations should also review their VPN logs for any signs of compromise attempts.
6Potential Attack Consequences
Successful exploitation could transform VPN appliances from secure entry points into beachheads within corporate networks. Attackers could gain persistent access, steal sensitive data, deploy ransomware, or move laterally across systems. The high CVSS score reflects the combination of low attack complexity and high impact on confidentiality, integrity, and availability.
7Vendor Response Timeline
Check Point responded promptly with patches released the same day the vulnerabilities were disclosed. The company provides detailed guidance on its support portal about which specific hotfixes address each vulnerability across different product versions. This rapid response is critical given the severity and the likelihood of imminent exploitation attempts.
8Urgent Action Required
This situation demands immediate attention from all Check Point VPN users. Organizations should treat this as a top-priority security incident, verifying their version status, applying patches, and implementing additional access controls without delay. IT teams should engage service providers immediately if unsure about their vulnerability status or patch implementation process.