# Dutch NCSC Warns of Critical Check Point VPN Flaws (CVE-2026-85102, CVE-2026-85103) — Exploitation Expected Imminently

> Check Point disclosed two unauthenticated remote-code-execution flaws in its VPN certificate-handling path — CVE-2026-85102 (improper certificate validation during VPN negotiation) and CVE-2026-85103 (heap overflow in the VPN certificate ASN.1 decoder) — both CVSS 9.8, affecting Security Gateway, Security Management Server, and Spark Firewall. Dutch NCSC issued a public alert on 2026-09-12 assessing exploitation likelihood and impact as high and expecting large-scale exploitation attempts soon; Check Point found the bugs internally and reports no public PoC or confirmed in-the-wild exploitation as of publication.

- **Published:** 2026-09-12T00:00:00Z
- **Last reviewed:** 2026-09-27T02:50:34.636Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2463
- **ID:** TL-2026-2463
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-85102, CVE-2026-85103

## Description

CVE-2026-85102 and CVE-2026-85103 both target the same pre-authentication attack surface: certificate handling in Check Point's VPN negotiation logic, before a peer is authenticated. CVE-2026-85102 (CWE-295, Improper Certificate Validation) is a flaw in how the VPN connection-setup process validates certificate data presented during negotiation, allowing an unauthenticated remote attacker to push the negotiation far enough to execute arbitrary code on the Security Gateway. CVE-2026-85103 (CWE-122, Heap-based Buffer Overflow) is a memory-corruption bug in the ASN.1 decoder used to parse VPN certificates; an attacker can trigger the overflow simply by sending a malicious certificate, and because the same decoder runs on Security Management Server as well as Security Gateway, this flaw has the broader blast radius — compromising the management plane could bypass downstream security controls across an entire managed fleet. Both CVEs carry CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and require no credentials and no user interaction.

Affected products are Check Point Quantum Security Gateway, Quantum Security Management Server, and Spark Firewall (centrally and locally managed) on R81.20, R82, and R82.10 below their respective patched Jumbo Hotfix Accumulator thresholds, plus all end-of-support branches (R80, R80.10, R80.20, R80.30, R80.40, R81, R81.10), which receive no further fixes. R82.20 is confirmed unaffected. Check Point published advisories sk1000117 and sk1000118 on 2026-09-07 with LivePatch Take 24 bundles that began automatic deployment on 2026-09-09, alongside manual Jumbo Hotfix Accumulator and Spark Firewall build updates. The only interim workaround — disabling implied VPN rules and restricting UDP/500 and UDP/4500 to known peer IP addresses — applies solely to Site-to-Site VPN; there is no mitigation for Remote Access VPN or locally managed Spark Firewalls short of patching.

Dutch NCSC's 2026-09-12 alert assessed both exploitation likelihood and potential impact as high, warning that active, large-scale misuse attempts are expected soon and could lead to system takeover, data theft or modification, and service disruption. As of the CISA KEV catalog snapshot dated 2026-09-11 (1,709 entries), neither CVE appears in KEV, and no public proof-of-concept exploit has surfaced. Industry analysis frames these disclosures as part of a broader 2026 pattern of pre-authentication 'auth gap' vulnerabilities in edge/perimeter software (also seen in PaperCut, N-able, Microsoft, SAP, and Ivanti products), where systems process untrusted data before confirming requestor legitimacy. Exposure scanning cited in that analysis found roughly 13,754 internet-facing Check Point VPN devices, including about 1,021 identified specifically as Quantum Security Gateways — a substantial pool of targets if mass exploitation begins.

A Check Point staff member clarified a scope detail not captured in the formal advisories: CVE-2026-85103's certificate-processing flaw runs through CPCA (Check Point Certificate Authority), which every Security Management Server operates independent of whether VPN is actively configured or in use, meaning management servers must be patched even in deployments where VPN itself is disabled or unused.

These two CVEs are explicitly distinct from Check Point's other 2026 VPN security incidents: CVE-2026-50751 (CVSS 9.3), an IKEv1 Remote Access/Mobile Access certificate-validation logic flaw enabling authentication bypass, actively exploited since 2026-05-07 against a few dozen targeted organizations and linked by Check Point to a Qilin ransomware affiliate before CISA added it to KEV on 2026-06-09; its sibling CVE-2026-50752 (CVSS 7.4), a related IKEv1 certificate-validation weakness enabling man-in-the-middle attacks on Site-to-Site VPN connections under specific conditions, with no observed in-the-wild exploitation; and CVE-2026-16232, another zero-day Check Point warned customers about earlier in the year. CVE-2026-85102/85103 stem from certificate validation and ASN.1 decoding defects in current VPN negotiation and CPCA processing, not the deprecated IKEv1 key-exchange logic exploited in CVE-2026-50751/50752, and no source ties Qilin or any other named actor to CVE-2026-85102/85103 specifically.

## MITRE ATT&CK

- T1595.001 Scanning IP Blocks
- T1595.002 Vulnerability Scanning
- T1592.002 Software
- T1587.004 Exploits
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1005 Data from Local System
- T1499.004 Application or System Exploitation
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1553 Subvert Trust Controls
- T1599 Network Boundary Bridging
- T1562 Impair Defenses
- T1562 Impair Defenses
- T1018 Remote System Discovery
- T1210 Exploitation of Remote Services
- T1587.003 Develop Capabilities
- T1090 Proxy
- T1046 Network Service Discovery

## Sources

- [Dutch NCSC Alert: Kritieke kwetsbaarheden in Check Point VPN-producten met actief misbruik verwacht](https://www.ncsc.nl/alerts/kritieke-kwetsbaarheden-in-check-point-vpn-producten-met-actief-misbruik-verwacht-update-nu)
- [Check Point sk1000117 — CVE-2026-85102](https://support.checkpoint.com/results/sk/sk1000117/)
- [Check Point sk1000118 — CVE-2026-85103](https://support.checkpoint.com/results/sk/sk1000118/)
- [Dutch NCSC critical Check Point VPN flaws, exploitation is imminent](https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/)
- [NVD — CVE-2026-85102](https://nvd.nist.gov/vuln/detail/CVE-2026-85102)
- [NVD — CVE-2026-85103](https://nvd.nist.gov/vuln/detail/CVE-2026-85103)
- [CISA Known Exploited Vulnerabilities Catalog (1,709 entries; CVE-2026-85102/85103 not listed)](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [Check Point Patches Critical VPN Vulnerabilities](https://www.securityweek.com/check-point-patches-critical-vpn-vulnerabilities/)
- [Critical Check Point VPN Vulnerabilities Enable Remote Code Execution Attacks](https://cybersecuritynews.com/check-point-vpn-vulnerabilities/)
- [Check Point Quantum VPN Drops Two CVSS 9.8 CVEs in the Same Certificate Path — VPN Infrastructure Joins the Auth Gap](https://forkast.news/check-point-quantum-vpn-drops-two-cvss-9-8-cves-in-the-same-certificate-path-vpn-infrastructure-joins-the-auth-gap/)
- [CVE-2026-85102 & 85103: Check Point VPN Flaws 9.8 CVSS RCE](https://securityonline.info/checkpoint-vpn-vulnerabilities/)
- [Check Point VPN Flaws CVE-2026-85102 and 85103 Rated 9.8](https://sqmagazine.co.uk/check-point-patches-vpn-certificate-flaws/)
- [Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE](https://www.hendryadrian.com/check-point-discloses-two-9-8-rated-vpn-certificate-flaws-enabling-unauthenticated-rce/)
- [Patch Critical Check Point VPN Vulnerability (CVE-2026-50751 / CVE-2026-50752)](https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/)
- [Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751)](https://www.helpnetsecurity.com/2026/06/08/check-point-cve-2026-50751-qilin-ransomware/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2463