Imminent Exploitation Warning
The Dutch National Cyber Security Centrum (NCSC) has issued a warning that exploitation of two critical vulnerabilities in Check Point VPN products is expected imminently. The agency stated it "assesses the likelihood of exploitation and the potential impact as high and expects exploitation attempts to occur soon" — language reserved for flaws with high real-world attack probability rather than theoretical risk.
The Vulnerabilities
| CVE | Description | Impact |
|---|---|---|
| CVE-2026-85102 | Improper certificate validation during VPN negotiation | Remote code execution on Security Gateways |
| CVE-2026-85103 | Heap overflow in the certificate decoder | Remote code execution on Security Gateways and Management Servers |
Both flaws are triggered during the VPN certificate handling process, meaning an attacker capable of reaching a vulnerable gateway's VPN negotiation endpoint could potentially achieve code execution without needing valid credentials first.
Affected Versions
Multiple actively supported and end-of-support releases are affected, including:
- R81.20, R82, R82.10
- R81.10.x
- Older end-of-support versions (R80 through R81.10)
R82.20 is not affected.
Fixes Available
Check Point released patches on September 9, 2026 via:
- LivePatch Take 24 for supported versions (applied automatically without requiring a reboot for Check Point Live Patch users)
- Several Jumbo Hotfix Accumulators
- Updated Spark builds
Recommended Actions
- Apply LivePatch Take 24 or the relevant Jumbo Hotfix Accumulator immediately — do not wait for a scheduled maintenance window given the imminent-exploitation warning
- For Site-to-Site VPN deployments, restrict VPN rules to trusted, known IP ranges as an interim mitigation while patching is completed
- Confirm patch status across all gateways and management servers, including any running end-of-support versions still in production
- Monitor VPN gateway logs for anomalous certificate negotiation attempts or crashes that could indicate exploitation attempts
Why This Matters
VPN gateways sit at the network perimeter by design, making critical RCE flaws in them especially high-value for attackers seeking initial access into enterprise networks. The NCSC's explicit "exploitation attempts expected soon" framing — rather than a standard advisory — signals that threat actors have likely already begun reverse-engineering the patches or developing exploits, a pattern seen repeatedly with other edge-device vulnerabilities disclosed in 2026.
Organizations still running end-of-support Check Point releases should treat this as an urgent forcing function to upgrade to a supported, patched version.