Cybersecurity News

Check Point VPN RCE Flaws: NCSC Warns Exploits Imminent

Published September 13, 2026 · DNS Benchmark Pro Editorial · Reading time: 6 minutes

TL;DR — The Dutch Nationaal Cyber Security Centrum (NCSC) issued an alert on 12 September warning that exploitation of two critical Check Point VPN flaws is expected shortly. CVE-2026-85102 is an improper validation of certificate data during VPN negotiation that yields arbitrary code execution on a Security Gateway; CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder that reaches both Security Gateways and Security Management Servers. Check Point shipped fixes on 9 September under advisories sk1000117 and sk1000118. Affected: R81.20, R82, R82.10, R81.10.x, R82.00.x and the end-of-support R80–R80.40, R81 and R81.10 trains. R82.20 is not affected. No public proof-of-concept exists yet — which is exactly why the window to patch is open today and probably not next week.

Most cybersecurity news arrives after the fact: a vendor advisory, then telemetry showing the flaw was already being exploited days earlier. This one is the rare inversion. The NCSC has published a warning ahead of any observed exploitation, stating plainly that it “assesses the likelihood of exploitation and the potential impact as high and expects exploitation attempts to occur soon.” For anyone running a Check Point Security Gateway at the network edge, that sentence is a scheduling instruction.

What CVE-2026-85102 and CVE-2026-85103 actually break

Both flaws live in the same place: the certificate handling that runs before a VPN tunnel is established. That location is what makes them serious. Certificate parsing happens during negotiation, on data supplied by whoever initiated the connection, before authentication has concluded anything about who that party is.

Identifier	Class	Impact
CVE-2026-85102	Improper validation of certificate data during VPN negotiation	Remote attacker executes arbitrary code on a Security Gateway.
CVE-2026-85103	Heap overflow in the VPN certificate ASN.1 decoder	Remote code execution on Security Gateways and Security Management Servers.

The second is the one worth dwelling on. ASN.1 decoding is a decades-old class of memory-safety hazard: a densely nested, length-prefixed binary encoding parsed in C, on attacker-supplied input, in a privileged process. The reason this class keeps generating cybersecurity news — a fresh zero-day vulnerability in a security appliance every few weeks — is structural, not accidental — the parser must accept malformed input in order to reject it, and rejection is where the bugs live.

That CVE-2026-85103 also reaches the Security Management Server changes the blast radius. A gateway compromise costs you one enforcement point. A management server compromise costs you the policy that governs every gateway it manages, which is a different category of incident entirely.

Affected versions and where the fixes landed

Affected: R81.20, R82, R82.10, R81.10.x, R82.00.x, plus end-of-support R80 through R80.40, R81 and R81.10
Not affected: R82.20
Check Point LivePatch Take 24 covers R81.20, R82 and R82.10
Jumbo Hotfix Accumulators: R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+
Spark: R82.00.10 Build 2325+, R81.10.17 Build 4968+

Check Point Live Patch (CPLP) users should have received protections automatically from 9 September, applying without a reboot. Two caveats matter: CPLP is unavailable outside R82.10, R82 and R81.20, and it does not support every configuration. “We run LivePatch” is a hypothesis to verify on each gateway, not a status to assume.

The end-of-support trains have no such option. R80 through R81.10 appear on the affected list with no fix behind them, which makes every remaining EoS gateway an unpatchable internet-facing box with a published pre-authentication code execution class against it.

Cybersecurity news verification with DNS Benchmark Pro, showing DNS server performance and network latency measurements used to confirm the resolution path behind a Check Point VPN Security Gateway after the CVE-2026-85102 and CVE-2026-85103 remote code execution advisories — Verified, unmodified capture from the DNS Benchmark Pro engine. A compromised VPN gateway sits inline with the resolvers its tunnel users depend on. Measuring **DNS server performance** and observed resolution from inside the tunnel reads live behaviour rather than declared configuration.

Why this cybersecurity news arrived before the attacks

National CSIRTs do not usually spend credibility on pre-exploitation warnings. The NCSC did here because the shape of this bug pair is familiar enough to forecast. Enterprise VPN appliances have been the most reliably attacked server infrastructure category of the past three years, and the interval between patch publication and working exploit for edge devices is now routinely measured in days.

There is also a diffing problem. Once a hotfix is public, the changed code is available to anyone willing to compare binaries — and certificate-parsing fixes tend to be small, localised, and legible. The absence of a public proof-of-concept on 12 September is not evidence of difficulty; it is a measure of how little time has passed.

The pattern repeats across vendors. Our coverage of the SonicWall SMA 1000 zero-day exploitation traced the same arc from advisory to mass scanning, and the Cisco Secure FMC exploitation two days ago showed what happens when the management plane itself is the target. Sound IT security practice now treats an edge-appliance advisory as an incident timer rather than a maintenance ticket.

The VPN gateway as a network latency and DNS chokepoint

A Check Point Security Gateway is not only a tunnel terminator. In most deployments it enforces policy, performs inspection, and sits directly in the resolution path for everything behind it — often forwarding or proxying DNS for tunnel clients. Code execution there hands an attacker a position, not just a host.

Three consequences follow for network teams.

The resolution path becomes editable. An attacker on the gateway can quietly redirect which resolver internal clients reach. No endpoint changes, no alerts, and nothing in the configuration you believe is deployed. This is where an appliance bug turns into a DNS security problem.
Inspection becomes interception. The gateway already terminates TLS in many configurations. That capability is neutral until someone else holds it.
Availability is the fallback. A gateway that can be crashed reliably is a denial-of-service primitive against every remote worker behind it, with an impact profile closer to a DDoS attack than to a data breach — no exfiltration required.

Encrypted transports help contain the first of those. Clients configured for DNS over HTTPS validate resolver identity through TLS rather than trusting whatever the network path advertises, which raises the cost of a silent redirection considerably. It is containment, not a substitute for the hotfix. The same logic applies to cloud security postures where gateways front hybrid workloads: the tunnel is a trust boundary, and a boundary you cannot verify is a boundary you do not have.

Chart from an earlier release of the DNS Benchmark Pro network diagnostic tool comparing DNS over HTTPS response times and network latency across public resolvers, referenced in cybersecurity news analysis of the Check Point VPN zero-day vulnerability warning from the Dutch NCSC — Unmodified capture from the DNS Benchmark Pro engine as it stood in August 2026. **Correction (15 August 2026):** the release that produced this chart timed opaque browser requests and did not verify that a response was a valid DNS answer, so the figures shown may include HTTP errors and unreadable replies counted as fast responses. They should not be relied on. The engine was rebuilt to validate every response; see the current methodology. The underlying point — that comparing the whole field beats trusting a single configured resolver — still holds.

What to do this weekend

Patch or confirm LivePatch coverage. Apply Take 24, the relevant Jumbo Hotfix Accumulator, or the Spark build. Where CPLP is in use, verify protection per gateway rather than per policy — it does not cover every version or configuration.
Restrict site-to-site VPN rules. The NCSC’s specific mitigation: limit access to specific, trusted IP addresses. For site-to-site tunnels the peer set is known and finite, so this costs little and closes the pre-authentication path to everyone else.
Inventory the EoS gateways. R80 through R81.10 are affected with no fix. Those boxes need an upgrade plan this quarter and network-level restriction today.
Hunt the negotiation logs. Look for malformed or unusual certificate payloads during IKE negotiation, repeated failed negotiations from single sources, and any gateway process crash or restart without a change record behind it. A heap overflow that misses leaves a crash before it leaves a shell.
Verify what tunnel clients actually resolve. A network diagnostic tool run from inside the tunnel confirms in minutes which resolvers answer and what network latency they carry — the fastest way to catch a redirection no change ticket explains.

Industry impact: the edge is still the soft centre

The through-line in 2026’s cybersecurity news is that the devices deployed to enforce security are the ones most reliably breaking it. Firewalls, VPN concentrators, management consoles, remote access gateways: internet-facing by design, running large C codebases, patched on change-control calendars built for a slower era, and trusted by everything behind them.

What is different here is the timing of the warning. Defenders have a genuine lead for once — patches published 9 September, a national CSIRT alert on 12 September, and no public exploit yet. That lead is the entire value of this particular piece of cybersecurity news, and it is perishable. Organisations that treat a pre-exploitation warning as a lower priority than a confirmed compromise have the incentive structure exactly backwards.

The durable lesson for tech infrastructure planning is unchanged: assume edge appliances will be exploited, shrink what they can reach, keep EoS hardware off the public internet, and measure what your network and its resolvers actually do rather than trusting the configuration you believe is deployed.

Sources: Nationaal Cyber Security Centrum (NL) alert on critical Check Point VPN vulnerabilities, 12 September 2026; Check Point security advisories sk1000117 and sk1000118 and associated community forum guidance, 9 September 2026; BleepingComputer, “Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent” (12 September 2026). This article is independent editorial analysis and is not affiliated with or endorsed by Check Point Software Technologies, the NCSC or CISA.