The Dutch Nationaal Cyber Security Centrum (NCSC) has issued a high-priority alert regarding two critical vulnerabilities within Check Point’s enterprise VPN solutions, warning that active exploitation is expected to begin in the immediate future. These security flaws, tracked as CVE-2026-85102 and CVE-2026-85103, pose a significant risk to organizations relying on Check Point Security Gateways and Management Servers for secure remote access. Although no public proof-of-concept (PoC) code has been released at this stage, the NCSC’s assessment—which classifies the potential for impact and the likelihood of exploitation as high—has prompted a wave of urgent security advisories across the cybersecurity landscape.
The vulnerabilities specifically target the core of Check Point’s VPN infrastructure, which is a staple in many global enterprise environments for facilitating encrypted, secure connections between remote workers and internal corporate resources. Given the critical nature of these gateways, they remain primary targets for threat actors, including state-sponsored groups and ransomware syndicates, who frequently exploit perimeter devices to gain an initial foothold into sensitive corporate networks.
Technical Breakdown of the Vulnerabilities
The two vulnerabilities, disclosed by Check Point on September 9, involve deep-seated issues within the VPN’s handling of cryptographic data.
CVE-2026-85102 centers on an improper validation of certificate data during the VPN negotiation process. Under normal circumstances, the VPN gateway should rigorously inspect the integrity and validity of certificates presented during the initial handshake. By exploiting this flaw, a remote, unauthenticated attacker could bypass these checks, leading to the execution of arbitrary code directly on the Security Gateway. Because the gateway sits at the edge of the network, such an execution provides an attacker with a high degree of control over traffic flow and potential lateral movement capabilities.
CVE-2026-85103 represents a heap overflow vulnerability within the VPN certificate ASN.1 decoder. ASN.1 (Abstract Syntax Notation One) is a standard interface for describing data in telecommunications and computer networking. In this instance, the flaw exists in how the decoder processes the complex structure of certificates. By sending a specially crafted certificate, an attacker could trigger a heap overflow, potentially leading to remote code execution (RCE) on both Security Gateways and Security Management Servers. This is particularly concerning as it allows for the subversion of the management server, which is effectively the "brain" of a Check Point deployment.
Chronology of Disclosure and Mitigation
The discovery and subsequent patch cycle followed a standard, albeit high-stakes, timeline. Check Point formally acknowledged these flaws on September 9, releasing security advisories sk1000117 and sk1000118. These documents outlined the necessary remediation steps, which vary depending on the specific product version and configuration.
The affected versions encompass a wide range of deployments:
- Supported releases: R81.20, R82, R82.10, R81.10.x, and R82.00.x.
- End-of-support (EoS) versions: R80 through R80.40, R81, and R81.10.
For organizations running the currently supported versions (R81.20, R82, and R82.10), Check Point released a LivePatch (Take 24) designed to remediate the vulnerabilities without requiring a server reboot, minimizing operational downtime. However, the situation for those on older, end-of-support versions is significantly more precarious, as these legacy systems are often harder to patch and may require manual intervention or migration to a supported version to ensure full protection. Notably, the most recent iteration, R82.20, remains unaffected by these specific vulnerabilities, signaling that Check Point had already integrated the necessary protections into its latest development cycle prior to the public disclosure.
The Role of Check Point LivePatch (CPLP)
A critical component of this response is the role of Check Point Live Patch (CPLP). According to internal community forum posts from the vendor, users who have enabled the automatic CPLP features should have received the necessary protections as of September 9. The advantage of this mechanism is that it provides a critical window of safety while system administrators schedule full maintenance cycles.
However, security professionals are cautioned that CPLP is not a universal panacea. It is not available for versions other than R82.10, R82, and R81.20, and it may not support all specific network configurations. Consequently, administrators cannot rely solely on the existence of the patch mechanism; they must verify via the Check Point management dashboard that the specific mitigation has been successfully applied to all relevant nodes.
Broader Implications for Enterprise Security
The NCSC’s warning highlights a growing trend in the cybersecurity industry: the targeting of "edge" infrastructure. VPNs, firewalls, and load balancers represent the most exposed surfaces of an organization. Because these devices are inherently designed to accept traffic from the public internet, they are the first line of defense—and the first point of failure.
When a vulnerability exists in a VPN gateway, the attacker does not need to compromise a user’s endpoint or trick an employee into clicking a phishing link. Instead, they can interact directly with the vulnerable service. If successful, the attacker gains a presence inside the perimeter, often with high-level privileges. This bypasses many secondary security controls, such as MFA, which typically protects the user identity rather than the infrastructure itself.
The potential for "full control," as noted by the NCSC, means that an attacker could view or modify sensitive data passing through the VPN, harvest credentials from memory, or deploy additional malware to move laterally into the internal data center. In the context of the modern threat landscape, where data exfiltration and ransomware deployment are the primary goals of advanced persistent threats (APTs), the speed of exploitation becomes the primary determinant of a breach’s success.
Recommended Defensive Measures
For organizations currently utilizing the affected Check Point products, the NCSC and industry experts recommend a multi-layered approach to mitigation:
- Immediate Patching: Prioritize the deployment of LivePatch Take 24 or the upgrade to version R82.20. Relying on perimeter security tools to "filter" the attack is insufficient, as the flaw lies within the protocol handling itself.
- Configuration Hardening: For organizations utilizing the ‘Site-to-Site VPN’ component, the recommendation is to enforce strict access control lists (ACLs). By modifying VPN rules to only allow connections from specific, trusted IP addresses, administrators can significantly reduce the attack surface, preventing unauthorized sources from even attempting to trigger the vulnerable code.
- Audit and Verify: Do not assume that automated updates have succeeded. System administrators should perform a manual audit of their Security Gateways to confirm that the patch version corresponds to the secure baseline provided in the September 9 advisory.
- Legacy Remediation: Organizations running EoS (End-of-Support) versions are at the highest risk. If an immediate upgrade is not possible, these devices should be isolated from the public internet using secondary firewalls or restricted through strict geofencing and VPN-access policies until the underlying software can be upgraded.
Conclusion and Future Outlook
The warning from the Dutch NCSC serves as a stark reminder of the fragile nature of network infrastructure. While software vendors continue to improve their development lifecycles, the complexity of modern network security appliances often leads to vulnerabilities that are deep-rooted in the cryptographic and protocol-parsing layers.
As of mid-2026, the cybersecurity community remains in a state of high alert. The expectation of imminent exploitation is based on the history of similar CVEs involving VPN gateways, which are typically weaponized by threat actors within days or even hours of a patch becoming public. For security teams, the mandate is clear: the time between the release of a critical patch and its application is the most dangerous window in the digital ecosystem. In this instance, the window is closing rapidly, and the pressure on IT departments to act decisively is higher than ever before.
