Critical Check Point VPN Flaws Face Imminent Exploitation

The Dutch National Cyber Security Centre has warned organisations to patch two critical Check Point VPN flaws immediately. The agency believes attackers could begin exploiting the vulnerabilities soon, despite the lack of a public proof-of-concept exploit.

Tracked as CVE-2026-85102 and CVE-2026-85103, both security issues can enable remote code execution. Successful attacks could therefore give threat actors full control of affected systems.

NCSC Warns Attacks Could Begin Soon

The Dutch NCSC assessed both the likelihood and potential impact of exploitation as high. As a result, it expects attackers to target vulnerable Check Point products in the near future.

Check Point VPN allows remote employees to access internal corporate networks through encrypted connections. Consequently, vulnerable gateways can provide an attractive entry point into sensitive business environments.

The agency warned that attackers could use the flaws to access or modify confidential information. In addition, they could disrupt operations or completely compromise affected systems.

Check Point released security updates for both vulnerabilities on September 9. Although researchers have not published a working exploit, administrators should not delay patching.

Two Vulnerabilities Allow Remote Code Execution

CVE-2026-85102 involves improper validation of certificate data during VPN negotiations. A remote attacker could exploit the weakness to run arbitrary code on a Security Gateway.

Meanwhile, CVE-2026-85103 affects the VPN certificate ASN.1 decoder. The heap overflow could allow remote code execution on Security Gateways and Security Management Servers.

The Check Point VPN flaws affect releases R81.20, R82, R82.10, R81.10.x and R82.00.x. End-of-support versions from R80 through R80.40, as well as R81 and R81.10, also remain vulnerable.

However, Check Point VPN R82.20 is not affected by either security issue.

Check Point Releases Patches

Check Point LivePatch Take 24 addresses both vulnerabilities on R81.20, R82 and R82.10. The company also included fixes in the following releases:

• R82.10 Jumbo Hotfix Accumulator Take 44 or later
• R82 Jumbo Hotfix Accumulator Take 126 or later
• R81.20 Jumbo Hotfix Accumulator Take 166 or later
• Spark R82.00.10 Build 2325 or later
• Spark R81.10.17 Build 4968 or later

LivePatch users should have received the available protections automatically from September 9. Moreover, the patches can take effect without restarting the server.

However, administrators should confirm that the protection is active. LivePatch mitigation only supports R81.20, R82 and R82.10, and it does not cover every configuration.

Administrators Urged to Restrict VPN Access

The NCSC advises organisations to install the relevant security updates as soon as possible. Administrators using the Site-to-Site VPN component should also tighten their VPN rules.

Specifically, organisations should limit access to trusted IP addresses wherever possible. This measure can reduce exposure while administrators verify or deploy the available patches.

Systems running unsupported Check Point releases face additional risk. Therefore, organisations should move to a supported version instead of relying on products that no longer receive regular security updates.