The Dutch National Cyber Security Centre (NCSC) warned of imminent in-the-wild exploitation targeting two critical vulnerabilities in Check Point Quantum Security Gateways, Quantum Security Management Servers, and Spark appliances. Tracked as CVE-2026-85102 and CVE-2026-85103 (both rated CVSS 9.8), the flaws enable pre-authentication remote code execution at root privileges. CVE-2026-85102 involves improper certificate trust validation during VPN session negotiation. CVE-2026-85103 introduces a heap buffer overflow in the ASN.1 certificate parsing engine, triggering code execution even on gateways with the VPN blade disabled if VPN certificates reside within the configuration.

Check Point released advisories sk1000117 and sk1000118 alongside LivePatch Take 24 and Jumbo Hotfix Accumulators for versions R81.20, R82, and R82.10. While public weaponized exploit code has not circulated, the Dutch NCSC assessed exploitation likelihood as high and anticipated imminent attacks against perimeter devices. Administrators unable to immediately deploy hotfixes must restrict VPN ingress ports to trusted source IP addresses to block unauthenticated network probes.

Why it matters:

• Pre-auth edge execution bypasses defense-in-depth: Processing untrusted ASN.1 structures before session authentication allows remote attackers to compromise the perimeter firewall itself, bypassing internal segmentation, decrypting transit traffic, and obtaining direct network pivot points into private subnets.
• Immediate patch verification and ingress containment: Security teams must immediately verify LivePatch deployment or install corresponding Jumbo Hotfixes across all Quantum and Spark gateways; perimeter firewalls awaiting maintenance windows must immediately enforce IP-whitelisted access on external VPN endpoints.