Organizations using Check Point VPN should monitor official Check Point advisories and apply security updates as released. Until patches are available, implement network segmentation and review VPN access controls to reduce attack surface.
Check Point researchers have confirmed that threat actors are actively exploiting CVE-2026-85102, a pre-authentication remote code execution vulnerability in the VPN certificate-handling functionality of Security Gateway products. Exploitation does not require authentication, and the vendor has not disclosed full technical details in the available summary.
The Dutch Nationaal Cyber Security Centrum (NCSC) has issued a warning regarding the imminent exploitation of two critical vulnerabilities in Check Point VPN solutions. The flaws, tracked as CVE-2026-85102 and CVE-2026-85103, pose a significant risk of remote code execution or bypass of VPN security controls. Exploitation is reported as imminent, though specific exploit details have not been disclosed to avoid aiding threat actors. Organizations using Check Point VPN products globally are advised to monitor official advisories and apply updates as they become available.
