cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Dutch NCSC warns of imminent exploitation of two critical Check Point VPN flaws

· Original article ↗

Summary

The Dutch NCSC expects attacks on two critical Check Point VPN flaws soon. Affected organizations should install fixes and restrict Site-to-Site VPN access to trusted IP addresses.

Key points

  • CVE-2026-85102 involves improper certificate-data validation during VPN negotiation and could let a remote attacker execute code on a Security Gateway.
  • CVE-2026-85103 is a heap overflow that could enable remote code execution on Security Gateways and Security Management Servers.
  • Affected releases include R81.20, R82, R82.10, R81.10.x, R82.00.x, and several end-of-support versions. R82.20 is not affected.
  • Check Point has released fixes, including LivePatch Take 24 for R81.20, R82, and R82.10, as well as specified Jumbo Hotfix and Spark builds.
  • The NCSC assesses exploitation likelihood and potential impact as high, though no public proof-of-concept exploit had been reported.
  • Administrators should install updates and restrict Site-to-Site VPN rules to specific trusted IP addresses. LivePatch protections are limited to certain versions and configurations.

Article Details

Vulnerability Types
  • Improper validation of certificate data during VPN negotiation
  • Heap overflow in the VPN certificate ASN.1 decoder
Severity
Critical
Affected Versions
  • Check Point VPN R81.20
  • Check Point VPN R82
  • Check Point VPN R82.10
  • Check Point VPN R81.10.x
  • Check Point VPN R82.00.x
  • Check Point VPN R80 through R80.40
  • Check Point VPN R81
  • Check Point VPN R81.10
Exploitation Status
reported
Exploit Availability
none_reported
Patch Status
available
Workarounds
  • For Site-to-Site VPN, modify VPN rules to limit access to specific, trusted IP addresses.

CVE

CVE-2026-85102checkpoint · Quantum Security GatewayThe Dutch NCSC is warning that two critical Check Point VPN flaws, CVE-2026-85102 and CVE-2026-85103, are likely to be exploited soon, with attackers potentially gaining remote code execution and full system control.CVE-2026-85103checkpoint · Quantum Security Gateway; checkpoint · Quantum Security ManagementThe Dutch NCSC is warning that two critical Check Point VPN flaws, CVE-2026-85102 and CVE-2026-85103, are likely to be exploited soon, with attackers potentially gaining remote code execution and full system control.

Vendors

Check PointThe Dutch NCSC is warning that two critical Check Point VPN flaws, CVE-2026-85102 and CVE-2026-85103, are likely to be exploited soon, with attackers potentially gaining remote code execution and full system control.

Products

Check Point LivePatchBoth flaws are fixed by Check Point LivePatch Take 24 for R81.20, R82, and R82.10, while fixes are also included in the following versions:Check Point VPNThe Dutch NCSC is warning that two critical Check Point VPN flaws, CVE-2026-85102 and CVE-2026-85103, are likely to be exploited soon, with attackers potentially gaining remote code execution and full system control.

Related Articles