Attacks on critical Check Point VPN flaws imminent, warning

Dutch NCSC urges organisations to patch immediately

The Dutch National Cyber Security Centre (NCSC) has warned organisations that attackers could soon exploit two critical vulnerabilities in Check Point VPN products.

The agency said the flaws, indexed as CVE-2026-85102 and CVE-2026-85103, carry a high risk of exploitation and could have serious consequences for affected systems.

Successful exploitation could allow attackers to take complete control of vulnerable systems, access or alter confidential information and disrupt business operations.

Although no public proof-of-concept exploit has emerged, the NCSC is urging organisations to apply the available security updates without delay.

“The NCSC assesses the chance of abuse and the possible damage as high and expects that attempts at abuse will take place soon,” the Dutch agency said.

"Check Point has released security updates that resolve the vulnerabilities. The NCSC advises installing these updates as soon as possible. For organiaations using Site-to-Site VPN, it is recommended to adjust certain VPN rules, such as disabling implied rules and restricting VPN access to specific IP addresses."

Check Point disclosed the vulnerabilities on 9th September and began releasing fixes the same day.

The company said it discovered both flaws itself and had no evidence that either had been exploited in attacks. However, it warned that both vulnerabilities could enable an unauthenticated remote attacker to execute code under specific conditions.

The first, CVE-2026-85102, involves improper validation of certificate trust during the VPN negotiation process. According to its CVE record, an attacker who does not need to authenticate could potentially execute code on a Security Gateway.

The second bug, CVE-2026-85103, is a heap-based buffer overflow that occurs while a VPN certificate's ASN.1 structure is being decoded. The flaw could potentially allow unauthenticated attackers to execute code on Quantum Security Gateway and Quantum Security Management systems.

Both vulnerabilities have been given a CVSS score of 9.8, placing them in the critical severity category.

Affected versions

The vulnerabilities affect R81.20, R82, R82.10, R81.10.x and R82.00.x. Several older, end-of-support releases, including R80 through R80.40, R81 and R81.10, are also affected.

Check Point has addressed the vulnerabilities through LivePatch Take 24 for R81.20, R82 and R82.10.

Other fixes include:

Check Point's R82.20 release is not affected by either vulnerability.

Administrators using the Site-to-Site VPN component have also been advised to modify their VPN rules so that access is restricted to specific, trusted IP addresses.

Organisations using Check Point Live Patch (CPLP) should also check that the automatic protection has been applied.

According to a post on Check Point's community forums, CPLP users should have received the available protections for both vulnerabilities from 9 September. The mitigation can be applied without restarting the server.

However, the automatic protection is not available for every version or configuration. It is limited to R82.10, R82 and R81.20, meaning administrators should verify that their systems are covered rather than assuming they are protected.

Check Point faces renewed scrutiny

The warning comes after several other serious Check Point vulnerabilities were exploited in the wild this year.

In June, the company patched CVE-2026-50751, an authentication-bypass vulnerability affecting Remote Access VPN and Mobile Access certificate validation.

The US Cybersecurity and Infrastructure Security Agency (CISA) subsequently added the flaw to its Known Exploited Vulnerabilities catalogue.

In July, Check Point fixed CVE-2026-16232, an authentication bypass affecting SmartConsole. CISA added that vulnerability to its catalogue on the day it was disclosed.