Our takeDutch NCSC says exploitation of the two critical Check Point VPN flaws (CVE-2026-85102/85103) is imminent. Patch via LivePatch or the fixed builds immediately if you run these VPNs.Cyber Resilience desk
Sources (5)
- bleeping · bleeping
- hackernews · hackernews
- securityweek · securityweek
- bleeping · bleeping
- cisa_kev · cisa_kev
What this means for you — Security leader:Apply Check Point's LivePatch for CVE-2026-85102 and CVE-2026-85103 on Security Management and Log Servers immediately. Scan internet-exposed VPN and management interfaces for signs of compromise.
What this means for you — Lean IT orgs:If you run Check Point VPN or management servers yourself, install the LivePatch update right away; most teams using cloud or managed firewalls can ignore this.
What this means for you — MSP:Check every client running Check Point Security Management, Log Servers, or VPN appliances and push the LivePatch immediately. Prioritize any with internet-facing management interfaces.
What this means for you — Researcher:Dutch NCSC warns of imminent in-the-wild exploitation of two critical Check Point RCE flaws (CVE-2026-85102, CVE-2026-85103). LivePatch is available; monitor for active exploitation attempts.