Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent
The Dutch Nationaal Cyber Security Centrum (NCSC) has issued a high-priority alert regarding two critical vulnerabilities within Check Point VPN solutions, warning that active exploitation by malicious actors is expected to commence in the immediate future. These vulnerabilities, formally tracked as CVE-2026-85102 and CVE-2026-85103, pose a significant risk to enterprise environments that rely on these gateways for secure remote connectivity. While there have been no confirmed public proof-of-concept (PoC) exploits circulating at this time, the NCSC’s assessment highlights a high potential for severe impact, urging organizations to prioritize the deployment of security patches without delay.
The vulnerabilities affect a wide array of Check Point’s Security Gateways and Security Management Servers, which serve as the backbone for encrypted remote access for thousands of corporations globally. The NCSC has explicitly stated that the likelihood of successful exploitation remains high, potentially granting attackers full control over compromised systems, the ability to exfiltrate sensitive data, and the capability to disrupt critical business operations.
Understanding the Vulnerabilities: A Technical Breakdown
The two flaws, detailed in Check Point’s security advisories sk1000117 and sk1000118, target core components of the VPN’s cryptographic and packet-handling architecture.
CVE-2026-85102 involves improper validation of certificate data during the VPN negotiation phase. In a standard VPN connection, the Security Gateway must verify the authenticity of a connecting client’s certificate. Because of this flaw, a remote, unauthenticated attacker could potentially bypass these validation checks. By providing a specially crafted certificate during the handshake, an attacker could trigger a condition that allows for the execution of arbitrary code directly on the Security Gateway. This is a particularly dangerous scenario, as the gateway often acts as the primary perimeter defense for internal corporate networks.
CVE-2026-85103 presents a different but equally severe risk: a heap overflow vulnerability located within the VPN certificate ASN.1 decoder. ASN.1 (Abstract Syntax Notation One) is a standard language for describing data structures used in telecommunications and computer networking, including the parsing of X.509 certificates. When the Security Gateway or Security Management Server attempts to parse an incoming certificate, the malformed data in the ASN.1 structure can cause a memory overflow. An attacker can leverage this memory corruption to overwrite critical execution paths, leading to Remote Code Execution (RCE). Because this vulnerability affects both the gateway and the management server, it could theoretically allow an attacker to pivot from the edge of the network into the core administrative infrastructure.
Chronology of the Disclosure
The timeline of these vulnerabilities began in early September 2026, when Check Point initiated its internal response protocols.
- September 9, 2026: Check Point officially published security advisories sk1000117 and sk1000118, acknowledging the existence of the vulnerabilities and providing the necessary patches for supported versions.
- Mid-September 2026: Security researchers and government agencies, including the Dutch NCSC, began analyzing the scope of the exposure.
- Late September 2026: The Dutch NCSC escalated its public warning, noting that despite the availability of patches, the window for preemptive remediation was closing as threat actors began probing for vulnerable instances.
- Ongoing: System administrators are currently in a race against time to deploy the Check Point LivePatch (CPLP) updates or perform manual firmware upgrades to secure their perimeters.
Affected Software Versions and Remediation Strategies
The reach of these vulnerabilities is extensive, impacting both current production releases and legacy versions that have reached their End-of-Support (EoS) status.
The affected versions include R81.20, R82, R82.10, R81.10.x, and R82.00.x. Furthermore, the vulnerability extends to older, unsupported releases, specifically R80 through R80.40, R81, and R81.10. Organizations still operating on these EoS versions are at the greatest risk, as they may not be able to apply standard patches without performing a major system upgrade.
Check Point has provided a path to remediation through its LivePatch (CPLP) system. For users on versions R81.20, R82, and R82.10, the CPLP Take 24 update addresses both CVEs. A distinct advantage of the CPLP system is that it allows for the deployment of security fixes without requiring a full server reboot, which is critical for enterprises that require 99.999% uptime. However, Check Point has cautioned that the CPLP mechanism is not universal. It does not support all network configurations and is unavailable for versions older than R81.20. Organizations operating on R82.20 remain unaffected by these specific vulnerabilities, serving as the benchmark for a secure environment.
Strategic Mitigations and Best Practices
For organizations that cannot immediately patch their systems, the NCSC and security experts have recommended a set of compensatory controls to minimize the attack surface.
The most critical recommendation for those utilizing "Site-to-Site VPN" components is to implement strict Access Control Lists (ACLs). By modifying VPN rules to limit access to specific, verified IP addresses, administrators can prevent unauthorized remote entities from even initiating the handshake process where the vulnerability lies. While this does not resolve the underlying flaw, it effectively isolates the vulnerability from the public internet.
Furthermore, administrators should conduct an immediate audit of their Check Point environments to determine if they are currently protected by the automatic CPLP mitigation. It is a common oversight to assume that automatic updates have been applied; manual verification via the Check Point community forums and administrative consoles is essential.
Broader Implications for Enterprise Cybersecurity
The emergence of these flaws underscores a recurring theme in modern cybersecurity: the vulnerability of "always-on" perimeter appliances. VPN gateways are high-value targets because they are inherently exposed to the public internet and require deep, privileged access to internal network resources. When these devices are compromised, the entire security architecture of the enterprise is effectively neutralized.
The situation with CVE-2026-85102 and CVE-2026-85103 also highlights the ongoing challenge of legacy system management. The fact that the vulnerability extends to R80-series versions—systems that may have been deployed years ago and forgotten—presents a significant challenge for CISOs. In large, decentralized organizations, maintaining an accurate inventory of every security appliance and its patch status is a Herculean task.
Industry analysts suggest that this event may accelerate the transition from traditional VPNs to Zero Trust Network Access (ZTNA) architectures. Unlike VPNs, which often grant broad access once a connection is established, ZTNA models verify every request based on identity, context, and device health. While this does not eliminate the possibility of bugs in software, it limits the blast radius of any single vulnerability.
Conclusion and Recommendations
The alert from the Dutch NCSC serves as a stark reminder that the security of an enterprise is only as strong as its most exposed gateway. With exploitation imminent, the responsibility falls squarely on IT departments to act with speed and precision.
Organizations are advised to take the following steps immediately:
- Inventory Assessment: Identify all Check Point VPN gateways currently in production, including those in secondary or disaster recovery sites.
- Patch Verification: Check against the list of affected versions (R81.20, R82, R82.10, R81.10.x, R82.00.x, and EoS versions).
- Deploy Patches: Apply CPLP Take 24 where possible or move to the secure R82.20 release.
- Implement Compensatory Controls: If patching is delayed, restrict access to VPN gateways to known, trusted IP addresses to block potential exploitation attempts.
- Monitor for Anomalies: Increase logging and monitoring for any unusual activity related to the VPN gateway, specifically focusing on failed certificate handshakes or unexpected process restarts.
The threat posed by CVE-2026-85102 and CVE-2026-85103 is not merely technical; it is an operational risk that requires coordinated, enterprise-wide attention. As the window of opportunity for attackers to reverse-engineer these patches and weaponize them closes, the urgency of these updates cannot be overstated. Organizations that fail to act risk not only the integrity of their data but the operational continuity of their entire infrastructure.
