NCSC Warns of Critical Check Point VPN Flaws as Large-Scale Exploitation Is Expected
Dutch NCSC warns of two critical CVSS 9.8 Check Point VPN flaws enabling unauthenticated remote code execution, urging immediate patching before mass exploitation.
The Dutch NCSC warned that CVE-2026-85102 and CVE-2026-85103, both rated 9.8 CVSS, allow unauthenticated remote attackers to execute arbitrary code on Check Point Quantum Security Gateway, Spark Firewall, and Security Management Server deployments when VPN is enabled. CVE-2026-85102 stems from improper certificate trust validation during VPN negotiation, while CVE-2026-85103 is a heap-based buffer overflow in ASN.1 certificate decoding. Check Point shipped emergency updates on September 9, 2026, including R82.10 Take 44, R82 Take 126, and R81.20 Take 166 or later, plus LivePatch for eligible systems. No public exploit code exists yet, but the NCSC rates exploitation likelihood high and recommends restricting UDP ports 500 and 4500 to known peers as a stopgap.
- Two CVSS 9.8 flaws enable unauthenticated RCE on internet-facing Check Point VPN gateways.
- Emergency patches and LivePatch rolled out September 9, 2026; Jumbo Hotfix Accumulators available.
- No public exploit code observed, but NCSC expects large-scale exploitation attempts soon.
- Admins should restrict UDP 500/4500 to known peer IPs and review VPN negotiation logs.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85102 | Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw | 9.8 | 54% | KEVPoC | KEV |
| CVE-2026-85103 | Unauthenticated RCE in Check Point Quantum VPN Certificate ASN.1 Decoding | 9.8 | — |
From the original article
2 min read at cybersecuritynews.com
The Dutch National Cyber Security Center (NCSC) has issued an urgent warning over two critical vulnerabilities in Check Point VPN products, saying it expects large-scale exploitation attempts in the near term. Organizations using affected Check Point gateways, management systems, or Spark Firewall products should deploy the available fixes immediately. Tracked as CVE-2026-85102 and CVE-2026-85103, both […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.