Cyber threats / Incident register

Dutch NCSC warns critical Check Point VPN flaws face imminent exploitation

Other · Sep 9, 2026
High STIX 2.1 MISP
Summary

The Dutch National Cyber Security Centre issued a warning that exploitation of CVE-2026-85102 and CVE-2026-85103 in Check Point VPN Security Gateway and Security Management Servers is imminent, assessing both likelihood and impact as high. CVE-2026-85102 is an improper certificate validation flaw during VPN negotiation enabling arbitrary code execution, while CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder permitting remote code execution; both are rated 9.8. Affected versions include R81.20, R82, R82.10, R81.10.x and R82.00.x plus end-of-support R80 through R81.10, with R82.20 unaffected. No public exploit code existed at time of reporting and neither CVE appears in the CISA KEV catalog as of version 2026.09.11. Patches shipped 9 September 2026.

Sources
Attribution
No confirmed threat actor; pre-exploitation advisory
Where
JP JapanSG SingaporeAU Australia
Also: Netherlands, Germany, United Kingdom
Sectors: Government, Financial Services, Critical Infrastructure, Manufacturing
EU relevance
High
Also affected EU member states (Germany, Netherlands)
Graded by rules: EU member states affected, EU response, EU sanctions, EU projects in the sector hit.