Dutch NCSC Warns of Imminent Check Point VPN RCE Exploits

The Dutch National Cyber Security Centrum (NCSC-NL) has issued an urgent high-priority advisory warning that active weaponization and in-the-wild exploitation of two critical vulnerabilities in Check Point VPN gateways is imminent. Tracked as CVE-2026-85102 and CVE-2026-85103, both vulnerabilities carry maximum severity CVSS v3.1 base scores of 9.8 (Critical).

The security flaws affect widespread enterprise deployments across Check Point Security Gateways, Security Management Servers, and Spark Firewall hardware running Gaia OS. Check Point addressed the vulnerabilities in out-of-band updates on September 9, 2026, but the NCSC assesses the likelihood and operational impact of adversarial exploitation as exceptionally high, urging immediate mitigation prior to public proof-of-concept (PoC) circulation.

Technical Analysis

Both vulnerabilities reside within Check Point's perimeter cryptographic verification and VPN protocol negotiation stacks:

• CVE-2026-85102 (Improper Certificate Validation & Remote Code Execution): During the IKE phase negotiation of Remote Access and Site-to-Site VPN sessions, the gateway fails to properly validate incoming certificate structures. An unauthenticated remote attacker can supply crafted certificate payloads to corrupt memory states across multiple core daemons, including cpca (Internal Certificate Authority), iked (Internet Key Exchange daemon), vpn kernel control routines, vpnrad (RADIUS authentication worker), wstlsd (Web SSL/TLS daemon), and cprid (Check Point Remote Installation Daemon). Successful exploitation triggers unauthenticated arbitrary code execution in the context of administrative gateway privileges.
• CVE-2026-85103 (ASN.1 Decoding Heap Overflow & RCE): This flaw stems from a heap-based buffer overflow within the ASN.1 decoding flow utilized during certificate parsing. Unlike CVE-2026-85102, which primarily targets edge gateways, CVE-2026-85103 affects both Security Gateways and Security Management Servers. By transmitting malformed ASN.1-encoded certificate structures during handshake initiation, an adversary triggers a predictable heap corruption, enabling remote code execution without prior authentication or valid credentials.

The vulnerabilities affect Check Point Gaia releases R81.20, R82, and R82.10, along with branch versions R81.10.x and R82.00.x. Legacy End-of-Support (EoS) versions—including R80 through R80.40, R81, and R81.10—also contain the vulnerable routines. Check Point confirmed that version R82.20 is not affected.

Attack Vector & Impact

The attack vector operates remotely across the public internet without requiring valid authentication, pre-existing access tokens, or user interaction:

• Initial Access (T1190): Threat actors scan for publicly exposed Check Point VPN endpoints listening on UDP port 500 (IKE) and UDP port 4500 (NAT-Traversal / IPsec).
• Payload Delivery & Heap Manipulation: The adversary transmits malicious IKE negotiation requests encapsulating crafted ASN.1 certificate structures, triggering a heap overflow condition or certificate verification bypass.
• Execution & Persistence (T1068, T1133): Memory corruption yields immediate root-level shell execution on the gateway OS. Attackers can install persistent rootkits, deploy interactive reverse tunnels, and compromise internal cryptographic keys.
• Lateral Movement & Data Exfiltration: Once the edge security perimeter is breached, threat actors gain direct visibility into routed corporate networks, decrypt internal transit traffic, harvest Active Directory/LDAP credentials, and initiate lateral reconnaissance across internal subnets.

Edge networking devices remain high-priority targets for advanced persistent threat (APT) groups and state-sponsored espionage actors seeking persistent network footholds prior to ransomware deployment.

Detection & Mitigation

Security Operations Centers (SOCs) and network engineering teams must take immediate remediation action across all perimeter appliances:

Patch Deployment & LivePatch

• LivePatch Automation: Deploy Check Point LivePatch (CPLP) Take 24 (BUNDLE_URGENT_SECURITY_UPDATE_R82_10_AUTOUPDATE, R82, or R81_20). LivePatch installs without requiring gateway downtime or system reboots.
• Jumbo Hotfix Accumulators: For non-LivePatch environments, apply the latest cumulative hotfixes:
  • R82.10: Jumbo Hotfix Accumulator Take 44 or higher.
  • R82: Jumbo Hotfix Accumulator Take 126 or higher.
  • R81.20: Jumbo Hotfix Accumulator Take 166 or higher.
  • Spark Firewalls: R82.00.10 Build 2325+ or R81.10.17 Build 4968+.

CLI Verification (Expert Mode)

To validate that hotfixes and LivePatch modules are actively protecting the appliance, execute the following commands in Expert mode:

• cpinfo -y CPupdates — Validates that the Jumbo Hotfix Accumulator or Urgent Security Update package is installed.
• cplp list — Verifies active LivePatch mitigations across core daemons (cpca, iked, vpn, vpnrad, wstlsd, and cprid) on Security Gateways and ClusterXL members.
• g_all cplp list — Validates active LivePatch protection across all members on Scalable Platform Security Groups.

Expected output must confirm active protection against both CVE-2026-85102 and CVE-2026-85103.

Temporary Workarounds (Site-to-Site VPN)

For enterprise environments unable to apply immediate patches:

• In SmartConsole, disable implied rules for VPN.
• Explicitly restrict ingress access on UDP/500 and UDP/4500 strictly to known, trusted external peer IP addresses.
• Important: This workaround mitigates Site-to-Site VPN exposures but does not protect unauthenticated Remote Access VPN interfaces. Full patching remains strictly required.