Dutch NCSC warns of two critical Check Point VPN flaws

What happened

The Dutch National Cyber Security Centre (NCSC) has warned about two critical vulnerabilities in Check Point VPN products, according to the supplied report. Both flaws are rated 9.8 on the Common Vulnerability Scoring System (CVSS), the highest score stated in the report.

The report says the vulnerabilities could enable remote code execution and could soon be actively exploited; it does not establish that exploitation has occurred. Organizations using affected Check Point VPN products are urged to patch and restrict VPN access as a precaution.

The supplied material does not identify CVE numbers, affected product versions, a confirmed exploitation campaign, or the number of organizations at risk. It also does not provide technical details sufficient to assess whether the flaws are independently exploitable or whether a workaround exists.

Because VPN infrastructure can provide a path into protected environments, organizations should treat the warning as a high-priority exposure-management issue, validate which Check Point products and versions they operate, and follow available remediation guidance.

Until remediation is confirmed, reducing unnecessary external access may lower exposure, but specific controls should be tested for operational impact.