CVE-2026-85102 - Vulnerability Details - OpenCVE

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact total

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://support.checkpoint.com/results/sk/sk1000117

History

Wed, 09 Sep 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 09 Sep 2026 13:15:00 +0000

Type	Values Removed	Values Added
Description		Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Title		Improper Certificate Validation in Quantum Security Gateway
Weaknesses		CWE-295
References		https://support.checkpoint.com/results/sk/sk1000117
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: checkpoint

Published: 2026-09-09T13:00:31.206Z

Updated: 2026-09-09T15:14:09.431Z

Reserved: 2026-09-03T06:38:15.701Z

Link: CVE-2026-85102

Vulnrichment

Updated: 2026-09-09T15:14:06.479Z

NVD

Status : Awaiting Analysis

Published: 2026-09-09T13:20:43.793

Modified: 2026-09-09T16:17:13.180

Link: CVE-2026-85102

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-09T16:30:05Z

Weaknesses

CWE-295

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85102", "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45", "state": "PUBLISHED", "assignerShortName": "checkpoint", "dateReserved": "2026-09-03T06:38:15.701Z", "datePublished": "2026-09-09T13:00:31.206Z", "dateUpdated": "2026-09-09T15:14:09.431Z"}, "containers": {"cna": {"affected": [{"product": "Quantum Security Gateway", "vendor": "checkpoint", "versions": [{"status": "affected", "version": "R82.10 with Jumbo Hotfix Take 43 or below"}, {"status": "affected", "version": "R82 with Jumbo Hotfix Take 125 or below"}, {"status": "affected", "version": "R81.20 with Jumbo Hotfix Take 165 or below"}]}], "title": "Improper Certificate Validation in Quantum Security Gateway", "descriptions": [{"lang": "en", "value": "Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation.", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45", "shortName": "checkpoint", "dateUpdated": "2026-09-09T13:00:31.206Z"}, "references": [{"url": "https://support.checkpoint.com/results/sk/sk1000117"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-09T15:13:56.950640Z", "id": "CVE-2026-85102", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-09T15:14:09.431Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-85102", "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45", "state": "PUBLISHED", "assignerShortName": "checkpoint", "dateReserved": "2026-09-03T06:38:15.701Z", "datePublished": "2026-09-09T13:00:31.206Z", "dateUpdated": "2026-09-09T15:14:09.431Z"}, "containers": {"cna": {"affected": [{"product": "Quantum Security Gateway", "vendor": "checkpoint", "versions": [{"status": "affected", "version": "R82.10 with Jumbo Hotfix Take 43 or below"}, {"status": "affected", "version": "R82 with Jumbo Hotfix Take 125 or below"}, {"status": "affected", "version": "R81.20 with Jumbo Hotfix Take 165 or below"}]}], "title": "Improper Certificate Validation in Quantum Security Gateway", "descriptions": [{"lang": "en", "value": "Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295: Improper Certificate Validation.", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45", "shortName": "checkpoint", "dateUpdated": "2026-09-09T13:00:31.206Z"}, "references": [{"url": "https://support.checkpoint.com/results/sk/sk1000117"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-85102", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-09T15:13:56.950640Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-09T15:14:06.479Z"}}]}}