decrypted · 14 september 2026 · vulnerabilities and patching · supply chain · uk policy and law

The Check Point VPN flaws that haven't been exploited yet

Two Check Point VPN vulnerabilities patched on 9 September carry a CVSS score of 9.8 apiece, and the Dutch national cyber agency spent this week telling anyone still unpatched that exploitation is coming, not hypothetical. No public exploit code exists yet. That gap, between patch and mass exploitation, is the only leverage most UK organisations running Check Point gateways have left, and it will not stay open long.

Two 9.8s and a decoder that trusts strangers

CVE-2026-85102 is improper validation of certificate data during VPN negotiation; CVE-2026-85103 is a heap overflow in the ASN.1 decoder that parses those certificates. Both let an unauthenticated attacker run arbitrary code on a Security Gateway. Check Point shipped fixes on 9 September: LivePatch Take 24, or the relevant Jumbo Hotfix Accumulator (R82.10 Take 44 or later, R82 Take 126 or later, R81.20 Take 166 or later). R82.20 was never affected. Anyone still on end-of-support R80.x through R81.10 has no patch coming and needs to upgrade, full stop.

The Dutch NCSC's assessment, published 12 September, rates both likelihood and impact as high and expects exploitation attempts soon. For Site-to-Site VPN deployments it also recommends turning off implied VPN rules and locking UDP 500 and 4500 down to known peer IP addresses while patches roll out.

The design lesson

The vulnerable code is the part that decides whether to trust a stranger: a decoder parsing an attacker-supplied certificate structure, with a heap overflow sitting inside that parsing logic. That is precisely the class of bug that two years of memory-safety advocacy, NCSC included, has been aimed at: do not hand-parse untrusted binary data in a memory-unsafe language at the internet-facing edge of a security product. It is also, not for the first time, a Check Point VPN authentication flow. An NHS Digital alert from June covered a separate Check Point authentication bypass, CVE-2026-50751, already exploited in the wild by the Qilin ransomware operation. VPN gateways are not an occasional target; for ransomware crews they are the front door.

The compensating control the Dutch NCSC suggests, restricting VPN ports to known peers rather than leaving them open to the internet, is worth adopting as a standing default, not just a stopgap until this patch lands. A gateway that only ever expects traffic from a known set of peers has a smaller certificate-parsing attack surface to begin with. That is the Secure by Design habit worth keeping once this particular CVE fades from the advisories: minimise who gets to hand you a certificate to parse in the first place.

Also this week

A Twitch extension quietly forwarded 31,000 people's login tokens to Russia. A Chrome and Firefox extension called Twitch Enhanced Viewer, distributed under the name JeetBot, was found this week sending OAuth tokens (bearer credentials good for chat, whispers and account settings, no password or 2FA needed) to proxy servers run by a Russian commercial bot service, in the clear, inside a URL query string that then sat in the proxy's own logs. Ten Russian streamer channels were quietly exempted from the forwarding. The developer called it an oversight and patched it. The lesson for any UK organisation that lets staff install browser extensions freely: an official store listing is not a security review, and an OAuth token is a password by another name.

Parliament has approved digital ID checks for buying alcohol. The Licensing Act 2003 (Mandatory Licensing Conditions) (Amendment) Order 2026 cleared both Houses on 8 September and takes effect this autumn, letting pubs and shops accept certified digital proof-of-age services, such as Yoti and the Post Office, instead of physical ID. The design is worth noting given how contentious age verification has been elsewhere: the retailer receives only a yes-or-no confirmation that the customer is old enough and holds that credential, not the underlying document or date of birth. Government guidance is explicit that this is a data-minimisation requirement, not a courtesy. It is a rare example of an age-check scheme built to reveal less rather than more.

Sources

• Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent
• Dutch NCSC warns critical Check Point VPN flaws put networks at risk
• Exploitation of Authentication Bypass Vulnerability in Check Point VPN
• Malicious Twitch Browser Extension Leaks OAuth Tokens From Nearly 31,000 Users
• How digital verification services can be used to support alcohol purchases
• The Licensing Act 2003 (Mandatory Licensing Conditions) (Amendment) Order 2026

If any of this touches systems you're responsible for, get in touch.

More like this

• The GitLab flaw exploited within minutes of disclosure, and the check that came too late 21 august 2026
• The Metabase flaw in a password reset box, and the customers it caught 8 august 2026
• A crafted email is all it takes to root Cisco's mail gateway 15 september 2026

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.

Prefer to listen? Decrypted on Apple Podcasts, or paste the podcast feed into any app.