by Kastro
Paper/Archive/CVE-2026-85102

CVE-2026-85102

checkpoint Quantum Security Gateway — Improper Certificate Validation in Quantum Security Gateway

KEV · due 25 SepEPSS 54%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 99.0.990 × 2019.8Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

Affected

ProductAffectedFixed inSource
Quantum Security GatewayR82.10 with Jumbo Hotfix Take 43 or below–CNA
Quantum Security GatewayR82 with Jumbo Hotfix Take 125 or below–CNA
Quantum Security GatewayR81.20 with Jumbo Hotfix Take 165 or below–CNA

Scores by source

checkpoint (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refsupport.checkpoint.com/results/sk/sk1000117advisoryblog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102kevcisa.gov/known-exploited-vulnerabilities-catalog