Dutch NCSC warns Check Point VPN flaws could be exploited soon

On September 12, 2026, BleepingComputer reported that the Dutch Nationaal Cyber Security Centrum, or NCSC, warned organizations that exploitation of two critical Check Point VPN vulnerabilities is imminent. The flaws are tracked as CVE-2026-85102 and CVE-2026-85103, and both carry a CVSS score of 9.8. The agency urged immediate patching of Security Gateways and Spark Firewalls exposed through Remote Access VPN or Site-to-Site VPN. The warning turns a routine patch cycle into an urgent operational deadline for companies that rely on Check Point equipment to protect remote workers and branch offices.

Check Point VPN is an enterprise solution that allows remote employees to securely connect to their company internal network via encrypted connections. The same technology is used for Site-to-Site VPN links that join separate locations into one private network. That design makes the affected products attractive targets: they sit at the edge of the network, they accept connections from the internet, and they often have broad access to internal systems.

The Dutch NCSC published its alert titled Critical vulnerabilities in Check Point VPN products with active abuse expected: update now on September 10, 2026. The agency identified CVE-2026-85102 and CVE-2026-85103, both rated CVSS 9.8, and assessed the likelihood of abuse and the potential damage as high. It said no public proof-of-concept or exploit code had been reported yet, but it expects active large-scale abuse soon. The NCSC advised organizations to install the updates as quickly as possible.

Check Point issued fixes for the flaws on September 9, 2026, along with separate security advisories describing them: sk1000117 and sk1000118. SecurityWeek reported on September 11 that the company patched two critical-severity VPN flaws that could be exploited without authentication for remote code execution. The vendor said it discovered both vulnerabilities internally and that there is no evidence they have been exploited in the wild.

Key Facts

CVE-2026-85102 is described as an improper validation of certificate data during VPN negotiation. Check Point's advisory sk1000117, last modified on September 9, states that the issue may allow an unauthenticated remote attacker to execute arbitrary code on a Security Gateway. The advisory is marked Security Alert: Critical and lists a CVSS score of 9.8. CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder. It could allow remote code execution on Security Gateways and Security Management Servers. The Dutch NCSC said the first flaw sits in the process that establishes VPN connections, allowing an attacker without login credentials to bypass security and run their own code on the system. The second concerns an error in certificate processing, allowing an attacker to execute malicious code without an access code.

CVE-2026-85102 affects Security Gateway and Check Point Spark Firewall using Site-to-Site VPN or Remote Access VPN. CVE-2026-85103 impacts the Check Point Security Management Server, Security Gateway, and Spark Firewall. Affected releases include R81.20, R82, R82.10, R81.10.x, and R82.00.x, along with end-of-support versions R80 through R80.40, R81, and R81.10. Check Point VPN version R82.20 is not affected by either flaw. The broad version list means many environments will need to check more than one product family.

Both flaws are fixed by Check Point LivePatch Take 24 for R81.20, R82, and R82.10. Fixes are also included in Jumbo Hotfix Accumulator R82.10 Take 44 or later, R82 Take 126 or later, and R81.20 Take 166 or later. For Spark, the fixed builds are Spark R82.00.10 Build 2325 or later and Spark R81.10.17 Build 4968 or later. Customers with Check Point LivePatch enabled receive the patches automatically. Check Point says validation via the cpinfo -y CPupdates and cplp list commands should show cpcert:cpca, cpcert:iked, cpcert:vpn, cpcert:vpnrad, cpcert:wstlsd and cpcert_cprid entries covering CVE-2026-85102 and CVE-2026-85103.

As a mitigation, Check Point recommends manually defining VPN rules. For Site-to-Site VPN, the company says to disable implied rules for VPN and manually define VPN access for UDP/500 and UDP/4500 for the specific peer IP addresses. The Dutch NCSC repeated that advice for organizations using Site-to-Site VPN, telling them to adjust VPN rules and restrict VPN access to specific IP addresses. Check Point notes the mitigation does not apply to locally managed Spark Firewall instances, which should apply the latest Jumbo hotfixes as soon as possible.

Check Point says it discovered both vulnerabilities internally and that there is no evidence they have been exploited in the wild. SecurityWeek reported on September 11 that this summer the firm warned customers about exploitation of two zero-day vulnerabilities, including CVE-2026-16232 and CVE-2026-50751. The Dutch NCSC's alert links to advisory NCSC-2026-0365 and to Check Point's remediation page sk1000118.

Analysis

The immediate judgement is that this is no longer a patch-now-or-later situation. What this really means is that a national cyber security agency has decided the risk of exploitation is high enough to warn the public before any proof-of-concept exploit exists. The Dutch NCSC does not usually forecast large-scale abuse without reason. Its alert says the likelihood of abuse and the potential damage are high, and it expects exploitation attempts to occur soon. When a government body uses that language, enterprise defenders should treat the flaws as live threats, not theoretical ones.

The technical profile of the bugs explains the urgency. Both are unauthenticated remote code execution issues with a CVSS score of 9.8, the highest severity band. An attacker does not need valid credentials, and the affected services are reachable from the internet when Remote Access VPN or Site-to-Site VPN is enabled. The first flaw involves certificate validation during VPN negotiation, while the second is a heap overflow in ASN.1 certificate decoding. Those are exactly the kinds of pre-authentication parsing bugs that attackers look for in edge appliances, because a single crafted connection can lead to code execution.

The patch and mitigation path is also more complex than a single update. Check Point has fixed the issues through LivePatch Take 24 and several Jumbo Hotfix Accumulator releases, with separate build numbers for Spark. Organizations running older or end-of-support releases such as R80 through R80.40, R81, and R81.10 need to understand their exposure because those versions are listed among the affected releases. The recommended workaround for Site-to-Site VPN involves disabling implied rules and manually defining access for specific peer IP addresses on UDP/500 and UDP/4500, but Check Point says that mitigation does not apply to locally managed Spark Firewall instances.

The bigger picture here is that edge security appliances remain one of the most reliable paths into enterprise networks. Check Point is a major vendor, and its VPN and firewall products protect many organizations. The company discovered these flaws internally, which is a positive sign for its research process, but the Dutch NCSC still expects attackers to catch up quickly. The earlier summer zero-days, CVE-2026-16232 and CVE-2026-50751, show that Check Point customers have already been in attackers' sights this year.

Why It Matters

If the flaws are not fixed, the Dutch NCSC says an attacker could take full control of a system, view or modify confidential data, and disrupt operations. For a business, that could mean stolen customer records, altered financial data, ransomware deployment, or an outage that halts production. For public sector and critical infrastructure operators, the same access could affect services that citizens depend on. The NCSC warns of potentially serious damage to the organization if the vulnerabilities are not remediated.

The scale of the affected versions makes the problem wider than one product line. Security Gateways, Security Management Servers, and Spark Firewalls are all in scope for at least one of the flaws, and the affected releases include current branches such as R81.20, R82, and R82.10 as well as older end-of-support versions. Organizations that have not tracked their VPN estate may not know which devices are exposed through Remote Access VPN or Site-to-Site VPN.

The absence of a public proof-of-concept is not a reason to wait. The Dutch NCSC explicitly says it expects exploitation attempts to occur soon, and Check Point has already released fixes. Once a working exploit is published or used in the wild, the window for quiet patching closes. Because the bugs allow unauthenticated remote code execution, mass scanning and automated attacks are a realistic next step. Security teams should assume that any internet-facing Check Point VPN service is a target until it is confirmed patched or mitigated.

Next Up

Organizations should inventory Check Point Security Gateways, Security Management Servers, and Spark Firewalls that use Remote Access VPN or Site-to-Site VPN. They should apply Check Point LivePatch Take 24, the relevant Jumbo Hotfix Accumulator takes, or the fixed Spark builds, and then validate the installation with the cpinfo -y CPupdates and cplp list commands. Where patching cannot happen immediately, Site-to-Site VPN users should disable implied rules and restrict VPN access to specific trusted IP addresses on UDP/500 and UDP/4500. Locally managed Spark Firewall instances should move to the latest Jumbo hotfixes as soon as possible.

The coming days will show whether the Dutch NCSC's forecast is correct. Defenders should watch for public exploit code, scanning activity against VPN endpoints, and further advisories from Check Point or national agencies. R82.20 users are not affected by either flaw, but everyone else should confirm their version and patch status.