Dutch Cyber Agency Warns Check Point VPN Flaws Could Be Exploited Within Days

The Netherlands' National Cyber Security Centre (NCSC) has issued an urgent alert that two critical vulnerabilities in Check Point Software Technologies' virtual private network (VPN) product are on the brink of active exploitation. The flaws, catalogued as CVE-2026-85102 and CVE-2026-85103, are described by the agency as "critical" and "imminent" in their potential to compromise confidential data and network integrity.

According to the NCSC, the vulnerabilities affect the core authentication and encryption mechanisms of the VPN solution, allowing a remote attacker to bypass security controls and gain unauthorized access to internal systems. While the agency has not disclosed technical details that could aid malicious actors, it emphasizes that the risk is heightened for organisations that have not yet applied the vendor‑released patches.

Check Point disclosed the issues in a security advisory earlier this week and has made patches available to customers. The company advises immediate deployment of the updates and recommends that administrators verify the integrity of VPN configurations after installation. The NCSC echoes this advice, urging public‑sector bodies, critical‑infrastructure operators and private enterprises to prioritise the remediation.

The warning comes at a time when VPN usage has surged globally, driven by remote‑work arrangements and the need for secure connectivity across distributed environments. Cybersecurity experts note that attackers often target unpatched VPN services because they provide a direct conduit into otherwise segmented networks. An exploit of the reported flaws could enable data exfiltration, ransomware deployment or lateral movement within compromised organisations.

In response to the alert, the NCSC has opened a dedicated response channel for Dutch entities to report incidents and request technical assistance. The centre also plans to conduct follow‑up briefings with sector‑specific teams to assess the breadth of exposure and to share best‑practice guidance on hardening VPN deployments.

Stakeholders are advised to monitor vendor communications, apply the latest firmware, and conduct thorough post‑patch testing. As the NCSC cautions that exploitation is "imminent," organisations that delay remediation could face heightened exposure to sophisticated threat actors seeking to leverage the newly disclosed weaknesses.