Dutch NCSC warns Check Point VPN flaws

The Dutch Nationaal Cyber Security Centrum (NCSC) is warning that two critical flaws in Check Point VPN could be exploited soon. The agency says no public proof-of-concept exploit has been reported, but it is telling organisations to install security updates as soon as possible.

Two flaws under active scrutiny

The flaws are tracked as CVE-2026-85102 and CVE-2026-85103. According to the NCSC, the likelihood of exploitation and the potential impact are both high, and the agency expects exploitation attempts to occur soon.

Check Point VPN is an enterprise product that lets remote employees connect to a company's internal network over encrypted links. On September 9, Check Point issued fixes for the flaws along with separate security advisories, sk1000117 and sk1000118.

The first issue, CVE-2026-85102, is described as an improper validation of certificate data during VPN negotiation. A remote attacker could exploit it to execute arbitrary code on a Security Gateway. The second, CVE-2026-85103, is a heap overflow in the VPN certificate ASN.1 decoder that could allow remote code execution on Security Gateways and Security Management Servers.

What the NCSC actually says

The NCSC's alert states: the NCSC warns that the likelihood of exploitation and potential impact are high and that it expects exploitation attempts to occur soon.

“The NCSC assesses the likelihood of exploitation and the potential impact as high and expects exploitation attempts to occur soon,” the NCSC warns.

— Nationaal Cyber Security Centrum (NCSC)

The NCSC says exploitation of the flaws could allow an attacker to take full control of a system, view or modify confidential data, and disrupt operations. It urges system administrators to apply the security updates as soon as possible. For those using the Site-to-Site VPN component, it also advises modifying VPN rules to limit access to specific, trusted IP addresses.

Affected versions and fix paths

The affected releases include R81.20, R82, R82.10, R81.10.x, and R82.00.x. Also affected are the end-of-support (EoS) versions R80 through R80.40, R81, and R81.10. Check Point VPN version R82.20 is not affected by either flaw.

Both flaws are fixed by Check Point LivePatch Take 24 for R81.20, R82, and R82.10. Fixes are also included in the following versions:

• R82.10 Jumbo Hotfix Accumulator Take 44 or later
• R82 Jumbo Hotfix Accumulator Take 126 or later
• R81.20 Jumbo Hotfix Accumulator Take 166 or later
• Spark R82.00.10 Build 2325 or later
• Spark R81.10.17 Build 4968 or later

Mitigation through the community forums

According to a post in Check Point's community forums, users of Check Point Live Patch (CPLP) should have received all available protections for the two flaws since September 9, and those fixes should apply even without a server reboot.

The forum post adds that CPLP users should check whether they are protected by this automatic mitigation, as it is not available for versions other than R82.10, R82, and R81.20 and does not support all configurations.

What administrators should do first

Check Point and the NCSC both point administrators to the same first step: apply the available updates. The fixes are delivered through the LivePatch mechanism for the three most recent supported branches, or through the listed Jumbo Hotfix Accumulators and Spark builds.

For administrators on the affected end-of-support releases, the guidance in the sources does not provide a separate remediation path. Organisations running those versions will need to check the Check Point advisory and forum guidance for their specific deployment before making changes.

The NCSC's Site-to-Site VPN advice is narrower than a full patch: administrators using that component can modify VPN rules to limit access to specific, trusted IP addresses. That step does not fix the underlying flaw, but it reduces the exposure of a VPN endpoint to untrusted networks.

How the flaws work

Both vulnerabilities sit in the way Check Point VPN handles certificate data during negotiation. CVE-2026-85102 is an improper validation issue: certificate data presented during VPN negotiation is not checked as it should be, and the result is a path to arbitrary code execution on a Security Gateway.

CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder. That decoder processes certificate structures, and the overflow can lead to remote code execution on Security Gateways and Security Management Servers. Because the decoder is part of the VPN negotiation path, the flaw is reachable remotely by an attacker who can reach the affected service.

The source material does not describe how an attacker would trigger either flaw beyond these technical descriptions, and no public exploit has been reported. The NCSC's warning rests on its assessment of likelihood and impact rather than a confirmed in-the-wild campaign.

The response so far

Check Point shipped the fixes on September 9, alongside the two advisories and the community forum post about LivePatch coverage. The NCSC issued its alert urging organisations to update quickly. No public proof-of-concept exploit has been reported at the time of the source coverage.

That means the current state of the story is a warning, not a confirmed incident. The NCSC expects exploitation attempts to occur soon, but the basis for that expectation is the agency's own assessment, not a reported breach or a published exploit.

Why this matters for defenders

For organisations running Check Point VPN, the practical takeaway is narrow and immediate: identify which releases you run, check whether they fall in the affected list, and apply the relevant fix. The LivePatch route covers R81.20, R82, and R82.10 without a reboot, but it does not extend to every version or configuration, so administrators should verify their coverage rather than assume it.

The NCSC's warning matters because it comes from a national agency and frames the risk as high on both likelihood and impact. Even without a public exploit, that framing suggests organisations on affected versions should treat the update as time-sensitive. The Site-to-Site VPN rule restriction gives administrators a second lever while they plan and test the patch, particularly where a full upgrade is not immediately possible.

For the wider industry, the episode is a reminder that VPN concentrators remain a high-value target when certificate handling goes wrong. The flaws here are in negotiation and decoding logic, which sit on the path that any remote user or attacker must traverse to reach the internal network. That is why the NCSC's advice pairs patching with restricting who can reach the VPN in the first place. Administrators who follow both steps reduce the window in which an unpatched endpoint is exposed to the internet.