The Dutch National Cyber Security Center (NCSC) has issued an urgent warning over two critical vulnerabilities in Check Point VPN products, saying it expects large-scale exploitation attempts in the near term.
Organizations using affected Check Point gateways, management systems, or Spark Firewall products should deploy the available fixes immediately.
Tracked as CVE-2026-85102 and CVE-2026-85103, both flaws carry a CVSS severity score of 9.8 out of 10. The vulnerabilities can allow an unauthenticated remote attacker to execute arbitrary code, creating a serious risk for internet-facing VPN infrastructure.
Check Point VPN products commonly connect employees, offices, and networks securely over the internet. Because these systems sit at the network perimeter and often have privileged access to internal resources, a successful compromise could give attackers a path into enterprise environments.
CVE-2026-85102 affects the VPN negotiation process in Check Point Quantum Security Gateway devices. The issue stems from improper validation of certificate trust data during VPN connection setup.
NCSC Warns of Check Point VPN Flaws Exploitation
An external attacker may exploit the flaw without valid credentials, bypass authentication checks, and execute arbitrary code on a vulnerable Security Gateway.
The vulnerability affects Security Gateway and Check Point Spark Firewall products when Remote Access VPN or Site-to-Site VPN is enabled.
The second vulnerability, CVE-2026-85103, is a heap-based buffer overflow in the ASN.1 decoding flow for VPN certificates. ASN.1 is a data format commonly used in digital certificates.
A specially crafted certificate structure could trigger the memory corruption issue and enable remote code execution. Unlike the first flaw, this issue can affect Check Point Security Management Server deployments as well as Security Gateway and Spark Firewall products.
The NCSC said it has not seen public exploit code for the vulnerabilities, but assessed both the likelihood of exploitation and the potential impact as high.
The agency expects attackers to begin attempting widespread exploitation soon, making patching a priority rather than routine maintenance.
Successful exploitation could allow a threat actor to take control of an exposed appliance, access or alter confidential information, move further into connected networks, or disrupt business operations. A compromised VPN gateway can be especially valuable to attackers because it may provide trusted access to internal systems.
Check Point released emergency updates on September 9, 2026. Supported deployments should install the latest Jumbo Hotfix Accumulator, including R82.10 Take 44 or later, R82 Take 126 or later, and R81.20 Take 166 or later. Check Point LivePatch protection also began rolling out on September 9 for eligible systems.
For Site-to-Site VPN environments, administrators should also turn off implied VPN rules and explicitly limit UDP port 500 and UDP port 4500 access to known peer IP addresses. This reduces unnecessary exposure while patches are being validated and deployed.
Organizations should identify every externally reachable Check Point VPN appliance, confirm the installed software release and hotfix level, apply the appropriate update, and review logs for suspicious VPN negotiation or certificate-processing activity.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
