Critical severity · published Sep 9, 2026
CVE-2026-85102
Improper Certificate Validation in Quantum Security Gateway
In wildKEV
9.8
CVSS
54.1%
EPSS
Yes
On KEV
Description
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)54.1% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Sep 22, 2026
Federal remediation dueSep 25, 2026
Ransomware campaign useNot known
Affected products
Which versions
QS
Quantum Security Gateway · Check Point
R82.10 with Jumbo Hotfix Take 43 or below; R82 with Jumbo Hotfix Take 125 or below; R81.20 with Jumbo Hotfix Take 165 or below · source: vendor
GE
Gaia Embedded · Checkpoint
r81.10.00 before r81.10.17; r82.00.00 before r82.00.10; r81.10.17; r81.10.17; r81.10.17; r81.10.17; +15 more · source: NVD
GO
Gaia OS · Checkpoint
r80 before r81.10; r81.10; r81.10; r81.10; r81.10; r81.10; +34 more · source: NVD
MP
Multiple Products · Check Point
All versions, or not specified · source: KEV
In the news
VulnerabilityHigh
[CISA KEV] CVE-2026-85102: Check Point Multiple Products - Check Point Multiple Products Improper Certificate Validation Vulnerability
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
MPMultiple ProductsCVE-2026-85102
Sep 22, 2026·CISA KEV
VulnerabilityCritical
Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent
The Dutch Nationaal Cyber Security Centrum (NCSC) is warning of imminent exploitation of two critical flaws in Check Point VPN tracked as CVE-2026-85102 and CVE-2026-85103. [...]
Sep 12, 2026·BleepingComputer
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85102
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85102
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
support.checkpoint.com
https://support.checkpoint.com/results/sk/sk1000117
More from Quantum Security Gateway
9.3
CVE-2026-50751
User Authentication Bypass in VPN Remote Access and Mobile Access
9.8
CVE-2026-85103
Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding
8.1
CVE-2026-48132
VPN service may restart unexpectedly when processing IKE traffic over NAT-T 4500/UDP
8.1
CVE-2026-48131
VPND IKE Fragment Reassembly - Heap Out-of-Bounds Write via Sequence Number Zero
7.5
CVE-2026-62145
Local Privilege Escalation in Gaia Portal