Dutch NCSC Warns Check Point VPN Flaw Exploitation Is Imminent

Imminent Exploitation Warning

The Dutch National Cyber Security Centrum (NCSC) has issued a warning that exploitation of two critical vulnerabilities in Check Point VPN products is expected imminently. The agency stated it "assesses the likelihood of exploitation and the potential impact as high and expects exploitation attempts to occur soon" — language reserved for flaws with high real-world attack probability rather than theoretical risk.

The Vulnerabilities

Both flaws are triggered during the VPN certificate handling process, meaning an attacker capable of reaching a vulnerable gateway's VPN negotiation endpoint could potentially achieve code execution without needing valid credentials first.

Affected Versions

Multiple actively supported and end-of-support releases are affected, including:

• R81.20, R82, R82.10
• R81.10.x
• Older end-of-support versions (R80 through R81.10)

R82.20 is not affected.

Fixes Available

Check Point released patches on September 9, 2026 via:

• LivePatch Take 24 for supported versions (applied automatically without requiring a reboot for Check Point Live Patch users)
• Several Jumbo Hotfix Accumulators
• Updated Spark builds

Recommended Actions

1. Apply LivePatch Take 24 or the relevant Jumbo Hotfix Accumulator immediately — do not wait for a scheduled maintenance window given the imminent-exploitation warning
2. For Site-to-Site VPN deployments, restrict VPN rules to trusted, known IP ranges as an interim mitigation while patching is completed
3. Confirm patch status across all gateways and management servers, including any running end-of-support versions still in production
4. Monitor VPN gateway logs for anomalous certificate negotiation attempts or crashes that could indicate exploitation attempts

Why This Matters

VPN gateways sit at the network perimeter by design, making critical RCE flaws in them especially high-value for attackers seeking initial access into enterprise networks. The NCSC's explicit "exploitation attempts expected soon" framing — rather than a standard advisory — signals that threat actors have likely already begun reverse-engineering the patches or developing exploits, a pattern seen repeatedly with other edge-device vulnerabilities disclosed in 2026.

Organizations still running end-of-support Check Point releases should treat this as an urgent forcing function to upgrade to a supported, patched version.

Related Reading

• Artifactory Flaws Chained in Attacks Deploying Backdoor Malware