What Happened

The Dutch National Cyber Security Centre (NCSC) warned of two critical vulnerabilities in Check Point VPN products, identified as CVE-2026-85102 and CVE-2026-85103, each with a CVSS score of 9.8. The NCSC assesses the likelihood of exploitation and potential damage as high and expects active exploitation attempts soon. Check Point has released security updates to address both flaws.

Who Is Affected

Organizations using Check Point VPN products for secure remote access or site-to-site connections are affected. The vulnerabilities allow unauthenticated remote attackers to bypass security and execute arbitrary code (CVE-2026-85102) or exploit certificate processing flaws to run malicious code (CVE-2026-85103). Any organization running vulnerable versions without the latest patches is at risk.

Market Impact

This event creates immediate urgency for Check Point customers to patch and harden VPN configurations. Sales opportunities include:

• Offering emergency patching services and vulnerability assessments.
• Providing VPN rule hardening guidance (e.g., disabling implied rules, restricting IP access).
• Positioning alternative or complementary security solutions for organizations seeking to reduce reliance on Check Point.

What to Watch

Monitor for public proof-of-concept code or active exploitation reports. The NCSC expects large-scale exploitation soon. Check Point's advisory may be updated with additional mitigation steps. Competitors may use this event to target Check Point customers for migration or supplemental security tools.

Related coverage

• MikroTik RouterOS vulnerabilities actively exploited
• Adobe Commerce and Magento Exploit Actively Abused
• Active exploitation of vulnerabilities in SonicWall SMA 1000 devices
• Vulnerability in JFrog Artifactory Self-Hosted