Organization

Nationaal Cyber Security Centrum

1 mentions in 7 days · 1 in 30 days · 1 total · first seen Sep 12, 2026 · last 3d ago

Timeline1 articles

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

Dutch NCSC warns exploitation is imminent for critical Check Point VPN RCE flaws CVE-2026-85102 and CVE-2026-85103, urging immediate patching of Security Gateways.

The Dutch NCSC assesses the likelihood and impact of exploitation as high for two critical Check Point VPN flaws, though no public PoC exploit has been reported. CVE-2026-85102 is improper validation of certificate data during VPN negotiation, and CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder; both enable remote code execution on Security Gateways, the latter also on Security Management Servers. Affected releases span R81.20, R82, R82.10, R81.10.x, R82.00.x and EoS versions R80 through R81.10, while R82.20 is unaffected. Check Point shipped fixes on September 9 via LivePatch Take 24 and Jumbo Hotfix Accumulator takes, and NCSC advises restricting Site-to-Site VPN rules to trusted IPs.

BleepingComputerupdated Sep 14, 09:43 UTC · 2d agofirst Sep 12, 14:14 UTC · 3d agoVulnerability 9 sources CVE-2026-85102 CVE-2026-851032

Related CVEsby mentions

CVE-2026-851029.8—
Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw
CVE-2026-85102 is an improper certificate trust-validation flaw (CWE-295) in the VPN negotiation code of Check Point Quantum Security Gateways. An unauthenticated remote attacker who can reach the gateway's VPN service can trigger the flaw during VPN negotiation, where certificates involved in the exchange are not properly validated, and achieve code execution on the gateway. Successful exploitation yields arbitrary code execution on the gateway with high impact on confidentiality, integrity, and availability (CVSS 9.8), amounting to full compromise of the security gateway. The affected population is organizations running Quantum Security Gateways with VPN services reachable from untrusted networks. As of the available reporting there is no public proof-of-concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation is confirmed; the issue was disclosed alongside a second, similarly rated (9.8) Check Point VPN certificate-validation RCE flaw.
· Check Point Quantum Security Gateway (VPN negotiation functionality)large
CVE-2026-851039.8—
Unauthenticated RCE in Check Point Quantum VPN Certificate ASN.1 Decoding
CVE-2026-85103 is a heap-based buffer overflow (CWE-122) in the ASN.1 certificate-decoding code used by Check Point's VPN implementation, rated 9.8 Critical with a network-exploitable, unauthenticated, low-complexity vector. An unauthenticated remote attacker can trigger the flaw by sending crafted certificate data that the VPN service parses during connection handling, causing heap corruption that allows arbitrary code execution on the target system. Successful exploitation grants the attacker code execution with high confidentiality, integrity, and availability impact, which on security gateways and management servers could mean control of the security infrastructure itself. Any organization running Check Point Quantum Security Management or Quantum Security Gateway systems that process VPN certificate traffic is potentially affected, and the advisory set indicates this flaw was disclosed alongside a second, similarly rated 9.8 VPN certificate vulnerability (Check Point advisory AV26-902). There is no evidence of exploitation so far: the flaw is not in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.
· Check Point Quantum Security Management · Check Point Quantum Security Gatewaylarge

Appears with

product Check Point VPN 1 product Security Gateway 1 product Security Management Server 1 vendor Check Point 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.