The Netherlands’ National Cyber Security Center (NCSC) has warned organizations to urgently patch two critical vulnerabilities in Check Point VPN products, saying widespread exploitation attempts are likely to begin soon.
Tracked as CVE-2026-85102 and CVE-2026-85103, both flaws carry a CVSS severity score of 9.8 out of 10. The NCSC assesses both the probability of exploitation and the potential organizational impact as high.
Check Point VPN products are widely deployed to establish encrypted connections between users, branch offices, and corporate networks across the internet.
Critical Check Point VPN Flaws
Because VPN gateways are often internet-facing and provide access to internal resources, critical flaws in these systems can create an attractive initial-access route for threat actors.
CVE-2026-85102 affects the process that establishes VPN connections. According to the NCSC, an external attacker could exploit the issue without valid credentials, bypass security protections, and execute attacker-controlled code on the affected appliance or system.
The second vulnerability, CVE-2026-85103, involves certificate-processing functionality. An unauthenticated remote attacker may be able to exploit the certificate-handling flaw to execute malicious code, again without a password or authorized VPN access.
The combination of internet exposure, unauthenticated exploitation, and remote code execution makes the vulnerabilities particularly dangerous.
An attacker who gains code-execution capability on a VPN gateway could potentially use the device as a foothold for deeper intrusion into an organization’s environment.
Successful exploitation could allow attackers to take control of affected systems, view or alter confidential information, disrupt VPN services, or interfere with normal business operations.
Compromised VPN infrastructure can be especially valuable during ransomware, espionage, and data-theft operations. A threat actor may use access to inspect internal traffic, harvest credentials, move laterally to connected systems, or deploy additional malware.
No public proof-of-concept exploit code had been reported at the time of the NCSC alert. However, the agency said it expects active exploitation attempts on a large scale in the near term.
This warning is significant because attackers commonly scan for unpatched edge devices soon after critical vulnerabilities become public.
Security teams should therefore treat the flaws as an immediate exposure-management priority rather than waiting for confirmed exploitation activity.
Mitigations
Check Point has released security updates addressing CVE-2026-85102 and CVE-2026-85103. Organizations should identify all affected VPN deployments, validate their installed versions, and apply the relevant vendor patches as quickly as operationally possible.
Administrators should additionally review VPN gateway logs for unusual authentication activity, unexpected certificate-related errors, configuration changes, and suspicious outbound connections.
Organizations that cannot immediately patch should reduce external exposure where possible and consult their IT service provider or Check Point support team.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
 has warned organizations to urgently patch two critical vulnerabilities affecting Check Point VPN products, stating that widespread exploitation attempts are likely to begin soon.){kind=link}