CVE-2026-85102

Improper Certificate Validation in Quantum Security Gateway

Exploited in the wild. In CISA KEV since 2026‑09‑22. Fixed versions are out.

CVSS 3.19.8Critical EPSS percentile99th54% chance in 30 days CISA KEVListedsince 2026-09-22, due 2026-09-25
No public exploit known Fix3 products2 fixed builds listed below

Check it yourself

OpenVAS · 1 check

e.g. OID 1.3.6.1.4.1.25623.1.0.157915

Run the check

Published 2026-09-09Updated 2026-09-23Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

checkpoint Quantum Security GatewayAffected: R82.10 with Jumbo Hotfix Take 43 or belowUpgrade to: not statedAffected: R82 with Jumbo Hotfix Take 125 or belowUpgrade to: not statedAffected: R81.20 with Jumbo Hotfix Take 165 or belowUpgrade to: not statedStated by: CVE record
Checkpoint Gaia EmbeddedAffected: ≥ r81.10.00, < r81.10.17Upgrade to: r81.10.17Stated by: NVD
Checkpoint Gaia OsAffected: ≥ r80, < r81.10Upgrade to: r81.10Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your Check Point Quantum Security Gateway is reachable from the internet or any untrusted network (including from public IPs, port-forwarding, or broad firewall rules).
Identify whether your gateway is currently handling VPN negotiation/tunnel setup (e.g., has active or frequent VPN connection attempts).
If it is internet-reachable, immediately restrict network access to the gateway so only approved VPN clients or trusted networks can reach it.
Check with your vendor/IT team for an official fixed release for CVE-2026-85102; as of this report, no patch version is available, so prioritize temporary access restriction until a fix is published.
Log and monitor for repeated or unusual VPN negotiation attempts that may indicate impersonation/man-in-the-middle activity.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

4 publishers

Exploitation reported in the wild
as reported · Sep 23, 2026·BleepingComputer summary
Added to CISA KEV catalog
Sep 22, 2026·CISA KEV
Advisory coverage
as reported · Sep 12, 2026·BleepingComputer summary
Vendor patch released
as reported · Sep 11, 2026·SecurityWeek summary

Sourced from public security reporting — each date is when it was published, not when it happened. 8 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

In plain language

Written by AI from the record

CVE-2026-85102 is a critical flaw in Check Point Quantum Security Gateway that lets an attacker bypass certificate checks and, without authentication, run code on the device during VPN setup—so if your gateway is reachable and negotiating VPN connections, you should act now.

CVE-2026-85102 is an unauthenticated remote code execution in Check Point Quantum Security Gateway caused by improper SSL/TLS certificate validation during VPN tunnel (handshake) setup, allowing man-in-the-middle/impersonation to trick the gateway into trusting a malicious connection; it is reachable in the default configuration and does not require user interaction.

If you're affected

Full takeover of security gateway
Malware on the VPN device
VPN disruption and downtime
Possible exposure of internal data

What is it

Your VPN gateway is like a security guard that should only open the door when the visitor proves who they are. This flaw means the guard can be tricked during the initial “handshake” into trusting a fake connection, even without a login. If an attacker can reach your gateway and start a VPN negotiation, they may be able to run unwanted code on the gateway itself.

Who is affected

This matters if you run or administer Check Point Quantum Security Gateway and it can be reached over the network where VPN setup occurs. Because the vulnerability is reachable in the default configuration and requires no authentication or user action, it’s most concerning when the gateway is exposed to the internet or other untrusted networks. This is a risk when an attacker can reach the gateway and get it to attempt VPN negotiation (setup of the secure tunnel).

How urgent is it

This is urgent because it enables unauthenticated remote code execution on the Quantum Security Gateway during VPN handshake activity. Your risk is high if the gateway is reachable on the network and VPN negotiations happen, since attackers do not need stolen accounts or user interaction to attempt the attack.

What to do — in detail

Confirm exposure (findability)
- Verify whether Quantum Security Gateway is reachable from the internet or from any untrusted networks.
- Review firewall/NAT rules for public exposure of VPN negotiation endpoints and confirm whether those ports are restricted to known customer IP ranges or trusted VPN concentrators.
Confirm likelihood of handshake activity
- Check whether the gateway is actively negotiating VPN tunnels (typical for remote access usage).
- Note whether there are frequent connection attempts from wide IP ranges (which increases chances of malicious negotiation attempts).
Apply immediate mitigation (since no patch version is available yet)
- Restrict network access so only approved VPN clients or trusted networks can reach the gateway’s VPN negotiation services.
- If you have multiple access paths, close any unnecessary ones (for example, broad “allow from anywhere” rules).
Track for the vendor fix
- As of this report, no fix/patch information is available for CVE-2026-85102, so you should rely on network restriction until a vendor release is published.
- When a fixed release is published, upgrade to the version specified by the vendor for CVE-2026-85102 and validate gateway operation.
Detection and monitoring
- Monitor logs for repeated or unusual VPN negotiation attempts, especially from unexpected source IP ranges.
- Watch for signs of instability or unexpected changes on the gateway during or shortly after negotiation attempts.
Operational verification after changes
- After tightening access controls or upgrading, verify that legitimate VPN clients can still connect and that tunnel setup completes successfully.

Technical context

Severity and impact: The finding describes unauthenticated remote code execution on Check Point Quantum Security Gateway caused by improper certificate trust validation (CWE-295) during VPN handshake/tunnel setup. The attack involves man-in-the-middle or impersonation to make the gateway trust a malicious connection.

Attack requirements and reachability: The findings state authentication is not required, user interaction is not required, and it is reachable in the default configuration. Preconditions are network access to the gateway and an active VPN negotiation attempt.

Exploitation status: KEV listing is not present, and there is no clear dated press claim of exploitation. There is no public exploit code on record. Despite this, the overall verdict is RED, reflecting the combination of unauthenticated remote code execution and default reachability.

EPSS: A predicted likelihood value was provided, but public blocks should not repeat that prediction; no exploitation confirmation (KEV/news) was supplied in the findings.

KEV meaning here: Since CVE-2026-85102 is not listed in CISA KEV, there is no CISA-validated exploitation timeline in the provided findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

CISA KEV

Listed as exploited in the wild since 2026-09-22.

US federal agencies must remediate by 2026-09-25.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

54% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

18 events over 36 days, from the signal feeds we watch.

2026-10-15EPSS band change0 → highepss band change
2026-10-08Analysis publishedCheck Point Said "No Evidence" of Exploitation. Thirteen Days Later, CISA Had Confirmed Two Attacks — One Running Since July.
2026-10-07Analysis publishedF5's BIG-IP Zero-Day Only Fires If You Flipped One OAuth Setting. CISA KEV'd It Alongside Three Other Edge Appliances the Same Day.
2026-09-23Patch availableworkaround available, record updated, record updated
2026-09-22Added to CISA KEVrecord updated, record updated
2026-09-12OpenVAS check added

Affected products

checkpointcommercial · ILaka checkpoint firewall, check point firewall-1

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-295No name in the record

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

CollectionT1557Adversary-in-the-Middlehigh confidence

Sources

References in the record

Analysis on the cve.tools blog

In the news

All news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Quantum Security Gateway, not every advisory. This one: actively exploited.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account