CVE-2026-85102 & CVE-2026-85103: Check Point VPN Exploitation Imminent — Detection, Patching, and Hardening Guide

---
title: Check Point Gateway Local Account Created or Modified
id: 8f3e2a11-6c4b-4d9e-b7a2-1e5f9c3d8a60
status: experimental
description: Detects creation or modification of local user accounts on Check Point gateways via forwarded syslog/CEF. Local account creation on a perimeter VPN appliance is a strong post-compromise indicator when exploitation of the VPN blade is suspected.
references:
  - https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/
  - https://attack.mitre.org/techniques/T1136/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1136.001
logsource:
  product: checkpoint
  service: audit
detection:
  selection:
    - Message|contains:
        - 'add user'
        - 'set user'
        - 'add admin'
    - command|contains:
        - 'add user'
        - 'set user'
falsepositives:
  - Scheduled administrative changes via change management; correlate with approved tickets
level: high
---
title: Interactive Logon from VPN Address Pool Followed by Admin Tool Execution
id: 2b7c4d92-3a1f-4e68-9c55-7d0e8f2a1b34
status: experimental
description: Detects execution of reconnaissance or credential-access tooling on internal systems shortly after interactive logon, consistent with an intruder operating through a compromised VPN session. Tune the source-address filter to your VPN client IP pool in your SIEM correlation layer.
references:
  - https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.valid_accounts
  - attack.t1078
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\nltest.exe'
      - '\adfind.exe'
      - '\net.exe'
      - '\whoami.exe'
      - '\nltest.exe'
    CommandLine|contains:
      - 'net group "domain admins"'
      - 'net localgroup administrators'
      - '/domain'
falsepositives:
  - Helpdesk and sysadmin activity; baseline and whitelist admin jump hosts
level: medium
---
title: LSASS Access from Non-System Process After VPN Logon Window
id: 5e1a9f07-4c8d-4b2a-a3e6-9f0c2d7b5e18
status: experimental
description: Detects credential dumping attempts against LSASS, a common follow-on action after gaining internal access through a compromised VPN. High signal when correlated with sessions originating from VPN-assigned addresses.
references:
  - https://www.bleepingcomputer.com/news/security/dutch-ncsc-critical-check-point-vpn-flaws-exploitation-is-imminent/
  - https://attack.mitre.org/techniques/T1003.001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x1410'
      - '0x1FFFFF'
  filter_legitimate:
    SourceImage|endswith:
      - '\MsMpEng.exe'
      - '\svchost.exe'
      - '\wininit.exe'
  condition: selection and not filter_legitimate
falsepositives:
  - EDR/AV products and backup agents; add known-good SourceImage paths to filter
level: high

// Hunt: Anomalous Check Point VPN authentication and admin activity
// Adjust vpnPool and lookback to your environment
let lookback = 14d;
let adminWindow = 1h;
let authEvents = CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor =~ "Check Point"
| where DeviceProduct has_any ("VPN-1", "FireWall-1", "Quantum", "Mobile Access")
| extend Outcome = coalesce(Activity, "")
| project TimeGenerated, SourceIP, DestinationHostName, SourceUserID, Outcome, Message, DeviceAction;
// Signal 1: Success after burst of failures from same source
let failures = authEvents
| where DeviceAction has_any ("reject", "fail", "deny") or Message has "authentication failed"
| summarize FailCount = count() by SourceIP, bin(TimeGenerated, 5m)
| where FailCount >= 5;
let successes = authEvents
| where DeviceAction has "accept" or Message has_any ("logged in", "authentication succeeded", "login successful")
| project SuccessTime = TimeGenerated, SourceIP, SourceUserID, DestinationHostName;
let bruteThenSuccess = successes
| join kind=inner (failures) on SourceIP
| where SuccessTime between (TimeGenerated .. TimeGenerated + adminWindow)
| project SuccessTime, SourceIP, SourceUserID, DestinationHostName, FailCount;
// Signal 2: Gateway config / account changes
let adminChanges = CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor =~ "Check Point"
| where Message has_any ("add user", "set user", "add admin", "install policy", "policy installed")
| project TimeGenerated, SourceUserID, SourceIP, Message, DestinationHostName;
union bruteThenSuccess, adminChanges
| sort by TimeGenerated desc

// Hunt: Endpoint logons sourced from VPN pool followed by suspicious process execution
// Requires DeviceLogonEvents + DeviceProcessEvents; join key is the remote device
let vpnPool = dynamic(["10.90."] ); // replace with your VPN client pool prefix(es)
DeviceLogonEvents
| where TimeGenerated > ago(7d)
| where LogonType in ("Interactive", "RemoteInteractive", "Network")
| where RemoteIP has_any (vpnPool)
| project LogonTime = TimeGenerated, DeviceName, AccountName, RemoteIP
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ ("nltest.exe", "adfind.exe", "net.exe", "whoami.exe", "ipconfig.exe", "systeminfo.exe", "procdump.exe", "rundll32.exe")
    | project ProcessTime = TimeGenerated, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine
) on DeviceName
| where ProcessTime between (LogonTime .. LogonTime + 2h)
| where AccountName =~ InitiatingProcessAccountName
| project LogonTime, ProcessTime, DeviceName, AccountName, RemoteIP, FileName, ProcessCommandLine
| sort by LogonTime desc

-- Hunt: New local accounts and recon tool execution on VPN-accessible endpoints
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(nltest|adfind|net (group|localgroup|user)|whoami /all|systeminfo)'
   OR Exe =~ '(?i)(procdump|adfind|sharphound)'

-- Hunt: Local user accounts created in the last 14 days (Windows)
SELECT Name, Description, SID, LastLogon,
       timestamp(epoch=int(int=LastLogon)) AS LastLogonUTC
FROM wmi(query="SELECT Name, Description, SID FROM Win32_UserAccount WHERE LocalAccount=TRUE",
         namespace="root/cimv2")

#!/bin/bash
# Check Point VPN CVE-2026-85102 / CVE-2026-85103 posture verification
# Run from expert mode on each gateway and the management server

echo "=== 1. OS and version train ==="
show version all

echo "=== 2. Installed hotfixes / jumbo take ==="
# Verify the take matches or exceeds the build cited in Check Point's advisory for these CVEs
show installer status

echo "=== 3. Blades enabled (confirm VPN/Mobile Access exposure) ==="
enabled_blades

echo "=== 4. Confirm log forwarding to SIEM is active ==="
# On management: verify log exporter / syslog targets exist and are reachable
show syslog-servers 2>/dev/null || cp_log_export show 2>/dev/null

echo "=== 5. Local accounts defined on the gateway (audit for anything unexpected) ==="
clish -c "show users"

echo "=== 6. Recent admin logins (spot-check for unknown source IPs) ==="
fw log -n 100 2>/dev/null | head -50

echo "=== 7. If patching is not yet possible: disable password-only auth ==="
echo "Enforce certificate-based or MFA-backed authentication for all remote access."
echo "Reset ALL local gateway account passwords and any AD accounts that authenticated"
echo "via VPN in the exposure window if exploitation is confirmed."

# Companion script: identify internal hosts that received logons from the VPN pool
# in the last 14 days, for scoping after confirmed gateway compromise. Run on a DC or jump box.
$vpnPoolPrefix = "10.90."   # adjust to your VPN client address pool
$start = (Get-Date).AddDays(-14)

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624; StartTime=$start} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match "Logon Type:\s+(3|10)" -and $_.Message -match [regex]::Escape($vpnPoolPrefix) } |
  ForEach-Object {
    [PSCustomObject]@{
      TimeCreated   = $_.TimeCreated
      SourceIP      = ([regex]::Match($_.Message, 'Source Network Address:\s+([\d\.]+)')).Groups[1].Value
      TargetAccount = ([regex]::Match($_.Message, 'Account Name:\s+([^\s]+)')).Groups[1].Value
      TargetHost    = $env:COMPUTERNAME
    }
  } | Sort-Object TimeCreated -Descending | Export-Csv -Path ".\vpn_pool_logons.csv" -NoTypeInformation

Write-Output "Exported VPN-sourced logons to .\vpn_pool_logons.csv — pivot on TargetAccount for credential-reset scoping."