The Dutch National Cyber Security Centre (NCSC) has raised the alarm on two critical vulnerabilities in Check Point VPN appliances, stating that exploitation is imminent. Tracked as CVE-2026-85102 and CVE-2026-85103, these flaws allow unauthenticated remote code execution, placing organizations using affected Security Gateway devices at severe risk.
The vendor's own advisory, as reported by BleepingComputer, underscores the gravity of the situation. This is not a routine update but a critical incident requiring immediate intervention. VPN gateways are high-value targets, serving as trusted entry points into the network perimeter. Compromise of these devices grants attackers a direct, authenticated foothold inside the enterprise, bypassing conventional firewall defenses.
The vulnerabilities are specifically triggered when Check Point Security Gateway products are configured with certain VPN remote access functionality. Successful exploitation would permit an attacker to run arbitrary code on the gateway, potentially leading to full network compromise.
Mandatory Action Plan for Organizations
For IT and security teams, the response must be swift and structured. The Dutch NCSC and the broader security community outline a clear, prioritized directive:
- Patch Immediately: The primary, non-negotiable step is to deploy the security hotfixes released by Check Point for all affected Security Gateway versions. This is the critical first line of defense.
- Disable VPN if Patching is Delayed: If immediate patching is operationally impossible, the recommendation is to temporarily disable the VPN remote access feature on the vulnerable gateways. This contingency eliminates the attack vector until updates can be applied, presenting a necessary trade-off between security and operational continuity.
- Fortify Management Access: Conduct an emergency audit to ensure no management interfaces for security appliances, including Check Point devices, are exposed to the public internet. All administrative access should be restricted to trusted, internal networks.
- Heighten Detection: Elevate network monitoring and actively review logs for any signs of compromise or suspicious activity that may correlate with exploitation attempts against these CVEs.
A Universal Imperative
While the alert originates from the Netherlands, the threat is global. Any organization worldwide using vulnerable Check Point VPN configurations must treat this as a direct call to action. The assurance of imminent exploitation shifts the priority from standard maintenance to active incident response.
This event highlights the persistent risk facing edge network devices and the critical need for agile, decisive patch management. Verifying the status and configuration of Check Point VPN gateways must now be the top priority for security administrators everywhere.
荷蘭國家網絡安全中心（NCSC）對 Check Point VPN 裝置中的兩個重大漏洞發出警告，指出相關漏洞即將被利用。這兩個漏洞分別被編為 CVE-2026-85102 及 CVE-2026-85103，容許未經驗證的遠端程式碼執行，令使用受影響安全閘道器的機構面臨嚴重風險。
廠商透過 BleepingComputer 發布的通告強調了事態的嚴重性。這並非常規更新，而是需要即時介入的重大事故。VPN 閘道器是進入網絡邊界的可信入口點，屬高價值攻擊目標。一旦這些裝置被攻破，攻擊者便可繞過常規防火牆防禦，在企業內部取得已驗證的立足點。
漏洞在 Check Point 安全閘道器產品配置特定 VPN 遠端訪問功能時被觸發。若利用成功，攻擊者可在閘道器上執行任意代碼，最終可能導致整個網絡被完全控制。
機構必須執行的行動計劃
對於資訊科技及資訊保安團隊而言，應對措施必須迅速且有條理。荷蘭 NCSC 與更廣泛的資訊保安界別提出了清晰的優先指令：
- 立即安裝補丁： 首要且不容妥協的步驟，是為所有受影響的安全閘道器版本部署 Check Point 發佈的安全熱修補程式。此為關鍵的第一道防線。
- 若無法立即修補，請暫停 VPN： 如果因操作困難無法立即安裝補丁，建議臨時停用有漏洞閘道器的 VPN 遠端訪問功能。此應變措施可在套用更新前消除攻擊向量，是在資訊保安與操作連續性之間必要的權衡。
- 強化管理訪問控制： 進行緊急審計，確保安全裝置（包括 Check Point 設備）的所有管理界面均未暴露於公共網絡。所有管理訪問應限制於可信的內部網絡內。
- 加強檢測能力： 提升網絡監控級別，主動檢查日誌，留意任何可能與針對這些 CVE 的利用企圖相關的入侵跡象或可疑活動。
全球性緊急事態
雖然警報源於荷蘭，但威脅是全球性的。全球任何使用有漏洞 Check Point VPN 配置的機構，均須將此視為直接的行動號召。通告中「即將被利用」的斷言，將優先級從常規維護轉移到主動事故應對。
此事件突顯了邊緣網絡裝置面臨的持續風險，以及靈活、果斷的補丁管理之迫切需要。現時，核實 Check Point VPN 閘道器的狀態及配置，必須成為各地資訊保安管理員的首要任務。