Dutch NCSC Warns of Imminent Exploitation of Critical Check Point VPN Flaws

Why These Flaws Pose a Severe Immediate Threat

The Dutch National Cyber Security Centre (NCSC) has issued an urgent alert regarding two critical vulnerabilities in Check Point VPN products, identified as CVE-2026-85102 and CVE-2026-85103. Although no public proof-of-concept exploit has been observed yet, the agency warns that active exploitation is likely to begin imminently. The warning follows internal threat intelligence indicating increased scanning and probing activity targeting these specific flaws. Organizations using affected versions of Check Point’s remote access VPN solutions are urged to apply patches immediately or implement mitigations to reduce risk.

The vulnerabilities affect the SSL Network Extender and Mobile Access software blades in Check Point’s Security Gateway. CVE-2026-85102 involves an improper authentication bypass that could allow remote attackers to gain administrative access without credentials. CVE-2026-85103 is a path traversal flaw enabling unauthorized file system access, potentially leading to data theft or further system compromise. Both flaws are rated critical due to their network accessibility and low attack complexity. The NCSC emphasizes that successful exploitation could result in full network infiltration, particularly in environments where VPNs are exposed to the internet without additional layers of authentication.

How Can Organizations Respond Effectively?

The NCSC highlights that the combination of high severity, ease of exploitation, and widespread deployment of Check Point VPNs in government and enterprise networks increases the likelihood of rapid weaponization. Threat actors often prioritize VPN vulnerabilities as they provide a direct pivot point into internal networks, bypassing traditional perimeter defenses. The agency notes that historical patterns show exploits for similar flaws typically emerge within days of public disclosure, especially when no patch is applied. While Check Point has released updates, adoption lags remain a concern, particularly in sectors with complex change management processes. The NCSC urges organizations to treat this as an active threat scenario rather than a theoretical risk.

Immediate patching is the most effective defense, but the NCSC acknowledges that not all systems can be updated instantly. In such cases, they recommend restricting VPN access to known IP addresses, enabling multi-factor authentication, and monitoring for anomalous login attempts or unusual traffic patterns. Organizations should also verify that logging and alerting mechanisms are active on their Security Gateways to detect early signs of compromise. The NCSC offers free vulnerability scanning services for critical infrastructure providers to help identify exposed systems. Continuous threat intelligence sharing between public and private sectors is stressed as essential to staying ahead of fast-moving threats.

What versions of Check Point software are affected by CVE-2026-85102 and CVE-2026-85103? The vulnerabilities impact specific releases of Check Point’s Security Gateway running SSL Network Extender and Mobile Access blades. Exact affected versions are detailed in Check Point’s security advisory, but generally include recent major releases prior to the patched builds. Organizations should consult the vendor’s official notice for precise version mapping.

Frequently Asked Questions

Is there evidence that these flaws are already being exploited in the wild? As of the NCSC’s alert, no public proof-of-concept exploits or confirmed attacks have been reported. However, the agency cites internal indicators suggesting preparatory activity by threat actors, leading to their conclusion that exploitation is imminent rather than speculative.

What should I do if I cannot patch my Check Point VPN immediately? Apply temporary mitigations such as source IP restriction, enforce multi-factor authentication, and enhance monitoring for suspicious behavior. The NCSC advises treating the system as potentially compromised and preparing incident response procedures while working toward a permanent fix.