Improper Certificate Trust Validation in Check Point Quantum Security Gateway
CVE-2026-85102

9.8CRITICAL

Key Information:

Vendor

Checkpoint
Status
Quantum Security Gateway
Vendor
CVE Published:
9 September 2026

Badges

📈 Trended📈 Score: 3,120👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2026-85102?

CVE-2026-85102 is a serious vulnerability affecting the Check Point Quantum Security Gateway, a widely used network security appliance that provides advanced threat prevention and traffic encryption via a Virtual Private Network (VPN). The vulnerability arises from improper validation of certificates during the VPN negotiation process. This flaw allows unauthorized remote attackers to execute arbitrary code on the security gateway, potentially leading to unauthorized access to sensitive data, disruption of services, or further exploitation within the organization's network environment. The lack of robust certificate trust validation exposes organizations to heightened risks, particularly as remote work and reliance on VPN technologies continue to grow.

Potential impact of CVE-2026-85102

  1. Arbitrary Code Execution: Exploiting this vulnerability could enable an attacker to run arbitrary code on the Check Point Quantum Security Gateway, allowing for full control over the device. This level of access can lead to security breaches and manipulation of security controls.

  2. Data Loss or Exfiltration: With the ability to execute code on the gateway, attackers might access confidential data transmitted over the VPN. This could lead to significant data breaches, with sensitive information being stolen or compromised.

  3. Network Compromise: The successful exploitation of this vulnerability could allow attackers to pivot and attack other systems within the network. By gaining access to the gateway, they can potentially move laterally across the network, leading to a more extensive compromise of organizational infrastructure.

CISA has reported CVE-2026-85102

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-85102 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

Quantum Security Gateway R82.10 with Jumbo Hotfix Take 43 or below

Quantum Security Gateway R82 with Jumbo Hotfix Take 125 or below

Quantum Security Gateway R81.20 with Jumbo Hotfix Take 165 or below

News Articles

favicon imageHelp Net Security

Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances - Help Net Security

Check Point Management Servers and Spark firewalls and F5 BIG-IP APM instances targeted via zero-days, patches and IoCs released.

3 weeks ago

favicon imageBleepingComputer

Check Point warns of hackers exploiting Security Gateway VPN RCE flaw

Cybersecurity company Check Point has confirmed active exploitation of CVE-2026-85102, a pre-authentication remote code execution (RCE) vulnerability in the VPN certificate-handling functionality of its Security Gateway product.

3 weeks ago

favicon imageSwapupdate

Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks - SwapUpdate

Swati KhandelwalSep 22, 2026Network Security / Vulnerability

3 weeks ago

References

https://support.checkpoint.com/results/sk/sk1000117

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • 📰

    First article discovered by The Hacker News

  • 📈

    Vulnerability started trending

  • Vulnerability published

  • Vulnerability Reserved

.