As reported by SecurityAffairs, the Dutch National Cyber Security Centre (NCSC) has issued an urgent warning regarding two critical vulnerabilities in Check Point VPN products — CVE-2026-85102 and CVE-2026-85103 — both carrying a CVSS score of 9.8. These flaws enable unauthenticated remote code execution on Security Gateways and Security Management Servers, effectively turning perimeter appliances into entry points for network compromise.
This is a significant moment for enterprise defenders. Check Point appliances frequently sit at the network edge, processing authentication traffic from the internet. When the VPN concentrator itself becomes the execution target, traditional segmentation assumptions collapse. An attacker who gains code execution on a Security Gateway doesn't just breach a single system — they position themselves between internal users and their destinations, with potential to intercept credentials, pivot laterally, and persist undetected.
Vulnerability Details
| CVE ID | CVSS | Type | Component | Authentication |
|---|---|---|---|---|
| CVE-2026-85102 | 9.8 Critical | Security check bypass leading to RCE | VPN negotiation process | None required |
| CVE-2026-85103 | 9.8 Critical | Heap overflow leading to RCE | Certificate ASN.1 decoder | None required |
Affected Versions
Patch status: Check Point released fixes on September 9, 2025 via advisories sk1000117 and sk1000118. LivePatch Take 24 covers some supported versions without requiring a reboot. Organizations should verify whether their specific configuration received the LivePatch or requires a Jumbo Hotfix.
Active exploitation: Not yet observed in the wild. No public proof-of-concept exists. The NCSC assesses exploitation likelihood as high and expects attempts imminently.
Why This Matters Beyond the Headline
The ASN.1 heap overflow (CVE-2026-85103) is particularly notable. ASN.1 parsing vulnerabilities have historically been reliable exploit targets — the format's complexity and widespread use in certificate validation makes it fertile ground for memory corruption bugs. Attackers don't need valid credentials; they need only to submit a crafted certificate payload during VPN negotiation. This is pre-authentication exploitation at the network perimeter.
For organizations running end-of-support versions (R80–R81.10), the calculus is harsher. Check Point may not provide LivePatch or Jumbo Hotfix coverage for these branches, meaning the only viable mitigation is upgrade or aggressive network-layer isolation. This creates a two-tier response: supported-version shops patch quickly; unsupported-version shops face a harder decision about accelerated migration or compensating controls.
Who Is Most Exposed
- Enterprises using Check Point Site-to-Site VPN with permissive implied rules
- Organizations exposing Security Management Servers to internet-facing management interfaces
- Environments running R80–R81.10 without active vendor support contracts
- MSSPs and MSPs managing multiple Check Point deployments on behalf of clients
Shield53 Recommendations
Immediate Actions (within 24 hours):
- Inventory and verify: Identify all Check Point Security Gateways and Management Servers across your environment. Confirm running versions and whether LivePatch Take 24 has been applied.
- Patch supported versions: Apply sk1000117 and sk1000118 immediately. For versions where LivePatch is unavailable, deploy the appropriate Jumbo Hotfix. Verify patch application through the Check Point management console.
- Restrict VPN exposure: For Site-to-Site VPN, disable implied rules and restrict allowed peer IP addresses to known trusted endpoints only. For remote access VPN, enforce MFA and consider temporarily limiting access to critical admin accounts.
- Isolate management interfaces: Ensure Security Management Servers are not reachable from the internet. Restrict management access to specific internal subnets or jump hosts.
- Upgrade or isolate EOS versions: For R80–R81.10 deployments, initiate upgrade planning to a supported release. In the interim, place these appliances behind additional network controls or consider decommissioning if unused.
Detection and hardening (within 72 hours):
- Review gateway logs for anomalous VPN negotiation failures, unexpected certificate payloads, or process restarts on the appliance
- Enable enhanced logging on VPN components and forward to your SIEM for correlation
- Validate that IPS signatures are current — Check Point may release detection signatures for exploitation attempts
- Document the patch status of every appliance in a tracking sheet; assign owners for verification
The window between patch availability and active exploitation is narrowing. Threat actors increasingly monitor vendor advisories and reverse-engineer patches rapidly. Treating this as routine maintenance rather than an emergency response risks leaving your perimeter appliance as the first domino in a larger compromise.
