NCSC-NL expects Check Point VPN RCE any day. LivePatch Take 24 is the patch. Take 18 is not.

Two unauthenticated CVSS 9.8 certificate bugs on Quantum Gateway and Management. Check Point reports no exploitation. The Dutch NCSC assesses abuse as imminent.

RWP Ventures · 2026-09-13 · event 2026-09-09 · 11 min read · priority 8.4

Check Point says it found both internally and has no indication of active exploitation. That statement is still the vendor position. It is not the whole decision. The Dutch NCSC, in alert language dated 10 September and amplified in English on 12 September, assesses likelihood of abuse and impact as high and expects exploitation attempts soon, including large-scale attempts. No public PoC has been reported. CISA has not listed either CVE in KEV as of catalog version 2026.09.11. Treat internet-facing Quantum VPN as a patch-now perimeter, not as a confirmed compromise.

LivePatch Take 18 is not Take 24. Several CheckMates operators reported automatic rollout still sitting on earlier urgent-update takes the day of disclosure. Do not confuse “LivePatch is enabled” with “these two CVEs are armed.”

What happened

Check Point published sk1000117 and sk1000118 on 9 September and opened a CheckMates advisory the same day. CVE.org records match the SKs. 85102 is CWE-295 (improper certificate validation). 85103 is CWE-122 (heap-based buffer overflow). NVD published 85103 on 9 September; NIST has not yet assigned its own CVSS. Check Point scored both 9.8 itself.

Affected branches in the SKs: R81.20, R82, R82.10; Spark R81.10.x and R82.00.x; and EoS R80 through R80.40, R81, and R81.10. CVE product status additionally names Jumbo floors: R82.10 Take 43 or below, R82 Take 125 or below, R81.20 Take 165 or below. Fixed: LivePatch Take 24 on those three supported branches; Jumbo R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+; Spark R82.00.10 Build 2325+ and R81.10.17 Build 4968+. Canadian Centre for Cyber Security AV26-902 the same evening pointed operators at both SKs without adding versions.

NCSC-NL advisory NCSC-2026-0365 (10 September, 11:12 Europe/Amsterdam, priority High) restated both CVEs and wrote that the centre expects large-scale abuse attempts shortly. The public alert page is more direct: chance of abuse and possible damage are high; install the updates as soon as possible; no public exploit code reported yet. BleepingComputer carried that warning in English on 12 September.

This is not June. CVE-2026-50751 (Remote Access / Mobile Access certificate bypass, KEV 8 June, Qilin-linked) and CVE-2026-16232 (SmartConsole, KEV the day it was disclosed) are prior Check Point edge events this summer. They are background. They are not evidence that 85102/85103 are already in a ransomware kit.

Why it matters

Three facts should not be collapsed.

First: these are unauthenticated RCE on the VPN edge, not local privilege bugs and not “VPN misconfiguration.” 85102 rides IKE/certificate negotiation on Gateway and Spark that actually run Site-to-Site or Remote Access. 85103 is ASN.1 decoding of VPN certificates and reaches Security Management as well as Gateway. A Check Point staff reply on CheckMates said 85103 is about certificate processing, so it can theoretically fire in an environment without the VPN blade if VPN certificates are present. That is vendor language, not a recipe. Do not assume “VPN blade off” is a close for 85103.

Second: the vendor “no exploitation” line and the Dutch CERT “expect it soon” line can both be true. Check Point has not published IOCs because, as staff said in the same thread, indicators apply to exploits that already exist. NCSC-NL is not claiming a named victim. It is a national CERT putting a high-likelihood, high-impact clock on internet-facing VPN RCE of a class that was already KEV’d twice this summer on this vendor. We will not invent a Qilin campaign. We will not wait for KEV to treat the patch as optional.

Third: LivePatch is the operational failure mode. Take 24 is the package that arms cpcert:* rows for these two CVEs. Operators who still show earlier urgent-update takes, or EoS R81.10 with neither LivePatch nor Jumbo, are the exposed population. The Site-to-Site workaround — disable implied VPN rules, allow UDP/500 and UDP/4500 only to specific peer IPs — does not apply to locally managed Spark. Spark’s only path is the Jumbo/build listed in the SK.

We have no confirmed OT, ICS, or physical-process impact. A Check Point box in front of a plant is still an IT compromise of an industrial organization’s perimeter. Do not write a process event.

Who / what is affected

Technical context

RWP is not reproducing certificate blobs, IKE payloads, or ASN.1 structures. Check Point’s public description is enough for a defender: certificate trust is not validated correctly during VPN negotiation (85102); the ASN.1 decoder for VPN certificates can overflow the heap (85103). Attack surface that matters for hunting is the certificate-processing path — cpcert livepatches name cpca, iked, vpn, vpnrad, wstlsd, cprid.

ATT&CK mapping for what is stated by the CVE, not a hypothetical kill chain:

• Initial access: exploit public-facing application (T1190) — unauthenticated RCE on Gateway / Management / Spark
• Follow-on that is not claimed for these CVEs: ransomware, named actor, OT logic change

Threat / exploitation status

High confidence on: CVE identifiers, CVSS vectors, affected/fixed versions, LivePatch Take 24 as the supported-branch hotfix, NCSC-NL’s published assessment, KEV absence as of 11 September catalog. Moderate confidence that automatic LivePatch coverage was incomplete on disclosure day (multiple independent CheckMates reports; not a census). Low confidence on remaining internet-facing unpatched population and on whether a private exploit exists.

What defenders should do

1. Inventory every Quantum Gateway, Security Management Server, and Spark. Version, Jumbo take, whether LivePatch is enabled, whether Site-to-Site or Remote Access VPN is on, whether the box is reachable from untrusted networks on UDP/500, UDP/4500, or other certificate-processing listeners. Include plant-perimeter and contractor gateways. R82.20: document and close.

1. Patch now. Supported R81.20 / R82 / R82.10: LivePatch Take 24 (BUNDLE_URGENT_SECURITY_UPDATE_*_AUTOUPDATE take 24) or Jumbo R82.10 Take 44+, R82 Take 126+, R81.20 Take 166+. Spark: R82.00.10 Build 2325+ or R81.10.17 Build 4968+. EoS R80–R81.10: there is no LivePatch; plan an upgrade off EoS and restrict IKE to trusted peers until then. Check Point says LivePatch does not require a reboot. Confirm anyway.

1. Verify the patch, do not trust the enablement flag. In Expert mode: cpinfo -y CPupdates should show Take 24 of the urgent-security bundle; cplp list (or g_all cplp list on Scalable Platform) should show cpcert:* rows naming CVE-2026-85102 and CVE-2026-85103, preferably armed on the processes that actually run. ready with 0/0 PIDs on a process you do not run is expected. Take 18 is not a close.

1. If you cannot patch today and you run Site-to-Site VPN: Check Point’s workaround is disable implied VPN rules and allow UDP/500 and UDP/4500 only to specific peer IPs. That does not apply to locally managed Spark. It is exposure reduction, not a fix for 85103 on Management.

1. Hunt is second to the patch because exploitation is not confirmed. There are no vendor IOCs. Reasonable telemetry, not a compromise declaration: unexpected vpnd / iked / cpca crashes after 9 September; new admin or SIC anomalies on Management; IKE from non-peer addresses. If you do find post-exploitation, rotate VPN certificates, SIC, and admin credentials and treat the box as untrusted. The patch does not clean a gateway that already ran attacker code — same sentence as [Cisco FMC on 10 September](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/). We do not have evidence that sentence applies yet.

1. Sequence the rest of this week’s KEV clock. GitLab CVE-2026-85706 and ScreenConnect CVE-2026-84869 are due 14 September — see [yesterday’s Daily Top](/posts/2026-09-12-gitlab-cve-2026-85706-path-traversal/). MikroTik CVE-2026-86060 / CVE-2026-67277 were due today, 13 September. Cisco FMC CVE-2026-20079, NetScaler CVE-2026-19490, and Fortinet CVE-2025-25249 were due 12 September. Artifactory CVE-2026-42016 / 42018 due 25 September. These Check Point CVEs are not on that list. They are still the new unauthenticated VPN RCE.

This is not an exploitation guide. Use Check Point’s SKs and NCSC-NL’s alert.

RWP assessment

Score 8.4. Two unauthenticated CVSS 9.8 RCEs on Check Point VPN, with a national CERT saying exploitation is imminent, is the first material development after [yesterday’s GitLab KEV](/posts/2026-09-12-gitlab-cve-2026-85706-path-traversal/). RWP had not published a full assessment of CVE-2026-85102 / 85103. Yesterday we scored them 7.0 as a runner-up: vendor, no exploitation evidence, not KEV. The increment is NCSC-NL’s high-likelihood assessment plus the LivePatch coverage gap, not a new victim picture.

It does not outrank a KEV’d unauthenticated file-read that was already yesterday’s story. It does outrank BlueMoon (Proofpoint 9 September; SecurityWeek 12 September). BlueMoon chains Chrome V8 CVE-2026-85046 / CVE-2026-87491 with Windows ALPC CVE-2026-85880. We covered the Windows half on [9 September Patch Tuesday](/posts/2026-09-09-microsoft-patch-tuesday-windows-eop-zero-days/). Chrome is patched. Four China-aligned clusters is real espionage telemetry. It is not a new perimeter CVE.

It outranks ScreenConnect CVE-2026-84869 and Artifactory CVE-2026-42016 / 42018 joining KEV on 11 September. Those were yesterday’s runners-up. No new victim increment overnight. Hunt them on their due dates. They are not today’s new RCE.

Sunday is thin. CISA’s KEV catalog has not moved past 2026.09.11. We are not manufacturing a KEV row.

What we are watching

• Whether CISA lists 85102 / 85103, and whether the ransomware-use flag comes with it.
• A public PoC, Shadowserver/GreyNoise scanning, or a named crew (including Qilin, given CVE-2026-50751 this summer).
• LivePatch Take 24 coverage versus operators still on Take 17/18.
• EoS R81.10 population that has neither Jumbo nor LivePatch.
• Whether Check Point publishes IOCs after the first confirmed victim.
• GitLab 85706 and ScreenConnect 84869 sharing the 14 September due date.

Sources

• Check Point — sk1000117, CVE-2026-85102
• Check Point — sk1000118, CVE-2026-85103
• CVE.org — CVE-2026-85102
• CVE.org — CVE-2026-85103
• NVD — CVE-2026-85103
• NCSC-NL — Kritieke kwetsbaarheden in Check Point VPN-producten (alert, 10 September 2026)
• NCSC-NL — NCSC-2026-0365
• BleepingComputer — Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent
• SecurityWeek — Check Point Patches Critical VPN Vulnerabilities
• The Hacker News — Check Point Discloses Two 9.8-Rated VPN Certificate Flaws
• Check Point CheckMates — Critical Security Advisory: VPN Vulnerabilities
• Canadian Centre for Cyber Security — AV26-902
• CISA Known Exploited Vulnerabilities Catalog
• [RWP Daily Top, 12 September 2026 — GitLab CVE-2026-85706](/posts/2026-09-12-gitlab-cve-2026-85706-path-traversal/)
• [RWP Daily Top, 10 September 2026 — Cisco FMC CVE-2026-20079](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/)
• [RWP Daily Top, 9 September 2026 — Microsoft Patch Tuesday](/posts/2026-09-09-microsoft-patch-tuesday-windows-eop-zero-days/)