Urgent Fixes for Check Point VPN Vulnerabilities and Industry Implications

The Dutch National Cyber Security Centre (NCSC) has issued a warning regarding two critical vulnerabilities in Check Point VPN, tracked as CVE-2026-85102 and CVE-2026-85103, which could be exploited by attackers for remote code execution. The NCSC assesses the likelihood of exploitation and potential impact as high, expecting attempts to exploit these vulnerabilities to occur soon. On September 9, Check Point released security updates addressing these issues and urged affected organizations to install them as soon as possible. CVE-2026-85102 involves improper validation of certificate data during VPN negotiation, which could allow an attacker to execute arbitrary code on a Security Gateway; CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder that could permit remote code execution. Affected versions include R81.20, R82, and R82.10, among others. The NCSC also advised users of the 'Site-to-Site VPN' component to modify VPN rules to limit access to specific trusted IP addresses. Notably, while Check Point has stated that there is no evidence of these vulnerabilities being exploited in the wild, system administrators must act swiftly to mitigate potential security risks.