Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-85102 9.8
Check Point · Quantum Security Gateway · Added 2026-09-22 · Published 2026-09-09
3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityCheck Point Multiple Products Improper Certificate Validation Vulnerability
VendorCheck Point
ProductQuantum Security Gateway
Date added2026-09-22
Due date2026-09-25
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-295
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions

KEV: Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

NVD: Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-09-22 20:15 UTC
Searches5
Component defaultyes
Sources https://support.checkpoint.com/results/sk/sk1000117
https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
https://beazley.security/alerts-advisories/critical-remote-code-execution-vulnerabilities-in-check-point-quantum-security-gateway-and-security-management
https://securityonline.info/checkpoint-vpn-vulnerability-cve-2026-85102/
https://securityarsenal.com/blog/cve-2026-85102-and-cve-2026-85103-check-point-vpn-exploitation-imminent-detection-patching-and-hardening-guide
https://www.f5.com/labs/articles/weekly-threat-bulletin-september-16th-2026
https://nvd.nist.gov/vuln/detail/CVE-2026-85102

Hunting hypothesis agent

Hunt Check Point IKE VPN logs for anomalous certificate trust validation on UDP/500 and UDP/4500 — the IKED daemon accepts forged certs during handshake, enabling pre-auth RCE on gateways with certificate-based VPN auth.

Research details

ComponentIKE daemon (iked) certificate trust validation during VPN negotiation
PreconditionsAttacker must reach the VPN negotiation interface (UDP/500 or UDP/4500) on a Check Point Security Gateway or Spark Firewall running versions R80 through R82.10 (R82.20 is not affected). The target gateway must have certificate-based authentication enabled for Site-to-Site or Remote Access VPN — gateways using only pre-shared key authentication are not vulnerable. No authentication is required from the attacker side. agent
DeliveryIKE/IPSec VPN negotiation over UDP/500 and UDP/4500
Public PoCno
Advisoryhttps://support.checkpoint.com/results/sk/sk1000117
Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS 9.8) | No public proof-of-concept exploit available as of September 2026, but exploitation attempts are confirmed in the wild | Dutch NCSC-NL warned exploitation is imminent | The flaw fails to properly validate trust of a presented certificate during the IKE handshake, allowing an attacker to supply forged certificate data and trigger memory corruption leading to arbitrary code execution with administrative privileges.
SummaryCVE-2026-85102 is a critical (CVSS 9.8) improper certificate validation vulnerability in Check Point Quantum Security Gateway and Spark Firewall VPN products. The flaw in the IKE daemon certificate trust validation allows an unauthenticated remote attacker to execute arbitrary code during VPN negotiation by submitting forged certificate data. Affected versions span R80 through R82.10; R82.20 is not affected. Check Point has released LivePatch Take 26 and Jumbo Hotfix Accumulators to remediate the issue, and active exploitation attempts are now confirmed in the wild.

Tia coverage

First reported2026-09-09
First exploit report2026-09-16
Exploit report → KEV6 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

a-critical-exploited-check-point-management-vulnerability-cve-20a-newly-kev-listed-cisco-ise-bug-lets-an-unauthenticated-attackean-exploited-big-ip-apm-vulnerability-tracked-as-cve-2026-94127check-point-warns-of-exploited-security-gateway-vpn-rce-cve-2026cisa-2026-0908-cisa-adds-4-known-exploited-vulnerabilities-to-ca

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub