Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in

CVE-2026-85102

🗓️ 09 Sep 2026 13:00:31Reported by checkpointType 
cve
 cve🔗 web.nvd.nist.gov📰️ 11 Media mentions👁 138 Views

Unauthenticated RCE in Check Point Quantum Security Gateway via improper cert validation in VPN.

Related
Detection
Affected
Refs
Social
ReporterTitlePublishedViews
Family
bdu_fstec
BDU FSTEC		The vulnerability of Check Point Security Gateway and Check Point Spark Firewall, related to errors in the certificate validation process, allows attackers to execute arbitrary code.
17 Sep 202600:00
–bdu_fstec
circl
Circl		CVE-2026-85102
9 Sep 202614:07
–circl
cisa_kev
CISA KEV Catalog		Check Point Multiple Products Improper Certificate Validation Vulnerability
22 Sep 202600:00
–cisa_kev
checkpoint_security
CheckPoint Security		CVE-2026-85102 - Authentication Bypass and Remote Code Execution in Remote Access and Site-to-Site VPN
7 Sep 202600:00
–checkpoint_security
checkpoint_security
CheckPoint Security		CVE-2026-85103 - ASN.1 decoding heap overflow leading to a remote code execution
7 Sep 202600:00
–checkpoint_security
cvelist
Cvelist		CVE-2026-85102 Improper Certificate Validation in Quantum Security Gateway
9 Sep 202613:00
–cvelist
euvd
EUVD		EUVD-2026-75009
9 Sep 202613:00
–euvd
kitploit
Kitploit		CheckPoint-CVE-Webscanner
28 Sep 202609:44
–kitploit
ncsc
NCSC		Vulnerabilities found in Check Point VPN products
23 Sep 202608:28
–ncsc
nvd
NVD		CVE-2026-85102
9 Sep 202613:20
–nvd
Rows per page
NVD
Node
AND
OR
checkpointgaia_embeddedRanger81.10.00–r81.10.17
checkpointgaia_embeddedRanger82.00.00–r82.00.10
checkpointgaia_embeddedMatchr81.10.17-
checkpointgaia_embeddedMatchr81.10.17build_996004508
checkpointgaia_embeddedMatchr81.10.17build_996004620
checkpointgaia_embeddedMatchr81.10.17build_996004653
checkpointgaia_embeddedMatchr81.10.17build_996004721
checkpointgaia_embeddedMatchr81.10.17build_996004892
checkpointgaia_embeddedMatchr81.10.17build_996004901
checkpointgaia_embeddedMatchr81.10.17build_996004914
checkpointgaia_embeddedMatchr81.10.17build_996004936
checkpointgaia_embeddedMatchr82.00.10-
checkpointgaia_embeddedMatchr82.00.10build_998001559
checkpointgaia_embeddedMatchr82.00.10build_998001562
checkpointgaia_embeddedMatchr82.00.10build_998002110
checkpointgaia_embeddedMatchr82.00.10build_998002112
checkpointgaia_embeddedMatchr82.00.10build_998002133
checkpointgaia_embeddedMatchr82.00.10build_998002203
checkpointgaia_embeddedMatchr82.00.10build_998002216
checkpointgaia_embeddedMatchr82.00.10build_998002242
checkpointgaia_embeddedMatchr82.00.10build_998002279
OR
checkpointquantum_spark_1530Match-
checkpointquantum_spark_1535Match-
checkpointquantum_spark_1550Match-
checkpointquantum_spark_1555Match-
checkpointquantum_spark_1570Match-
checkpointquantum_spark_1570rMatch-
checkpointquantum_spark_1575Match-
checkpointquantum_spark_1575rMatch-
checkpointquantum_spark_1590Match-
checkpointquantum_spark_1595Match-
checkpointquantum_spark_1595rMatch-
checkpointquantum_spark_1600Match-
checkpointquantum_spark_1800Match-
checkpointquantum_spark_1900Match-
checkpointquantum_spark_2000Match-
checkpointquantum_spark_2530Match-
checkpointquantum_spark_2550Match-
checkpointquantum_spark_2560Match-
checkpointquantum_spark_2570Match-
checkpointquantum_spark_2580Match-
checkpointquantum_spark_2590Match-
Node
AND
OR
checkpointgaia_osRanger80–r81.10
checkpointgaia_osMatchr81.10-
checkpointgaia_osMatchr81.10take_106
checkpointgaia_osMatchr81.10take_107
checkpointgaia_osMatchr81.10take_109
checkpointgaia_osMatchr81.10take_110
checkpointgaia_osMatchr81.10take_113
checkpointgaia_osMatchr81.10take_128
checkpointgaia_osMatchr81.10take_129
checkpointgaia_osMatchr81.10take_130
checkpointgaia_osMatchr81.10take_131
checkpointgaia_osMatchr81.10take_132
checkpointgaia_osMatchr81.10take_135
checkpointgaia_osMatchr81.10take_139
checkpointgaia_osMatchr81.10take_14
checkpointgaia_osMatchr81.10take_141
checkpointgaia_osMatchr81.10take_150
checkpointgaia_osMatchr81.10take_152
checkpointgaia_osMatchr81.10take_156
checkpointgaia_osMatchr81.10take_158
checkpointgaia_osMatchr81.10take_165
checkpointgaia_osMatchr81.10take_169
checkpointgaia_osMatchr81.10take_170
checkpointgaia_osMatchr81.10take_171
checkpointgaia_osMatchr81.10take_172
checkpointgaia_osMatchr81.10take_173
checkpointgaia_osMatchr81.10take_174
checkpointgaia_osMatchr81.10take_177
checkpointgaia_osMatchr81.10take_181
checkpointgaia_osMatchr81.10take_183
checkpointgaia_osMatchr81.10take_187
checkpointgaia_osMatchr81.10take_22
checkpointgaia_osMatchr81.10take_30
checkpointgaia_osMatchr81.10take_38
checkpointgaia_osMatchr81.10take_44
checkpointgaia_osMatchr81.10take_45
checkpointgaia_osMatchr81.10take_55
checkpointgaia_osMatchr81.10take_61
checkpointgaia_osMatchr81.10take_66
checkpointgaia_osMatchr81.10take_75
checkpointgaia_osMatchr81.10take_78
checkpointgaia_osMatchr81.10take_79
checkpointgaia_osMatchr81.10take_81
checkpointgaia_osMatchr81.10take_82
checkpointgaia_osMatchr81.10take_85
checkpointgaia_osMatchr81.10take_87
checkpointgaia_osMatchr81.10take_9
checkpointgaia_osMatchr81.10take_93
checkpointgaia_osMatchr81.10take_94
checkpointgaia_osMatchr81.10take_95
checkpointgaia_osMatchr81.20-
checkpointgaia_osMatchr81.20take_10
checkpointgaia_osMatchr81.20take_101
checkpointgaia_osMatchr81.20take_103
checkpointgaia_osMatchr81.20take_105
checkpointgaia_osMatchr81.20take_111
checkpointgaia_osMatchr81.20take_113
checkpointgaia_osMatchr81.20take_115
checkpointgaia_osMatchr81.20take_118
checkpointgaia_osMatchr81.20take_119
checkpointgaia_osMatchr81.20take_120
checkpointgaia_osMatchr81.20take_122
checkpointgaia_osMatchr81.20take_126
checkpointgaia_osMatchr81.20take_127
checkpointgaia_osMatchr81.20take_14
checkpointgaia_osMatchr81.20take_141
checkpointgaia_osMatchr81.20take_146
checkpointgaia_osMatchr81.20take_158
checkpointgaia_osMatchr81.20take_161
checkpointgaia_osMatchr81.20take_24
checkpointgaia_osMatchr81.20take_26
checkpointgaia_osMatchr81.20take_38
checkpointgaia_osMatchr81.20take_41
checkpointgaia_osMatchr81.20take_43
checkpointgaia_osMatchr81.20take_45
checkpointgaia_osMatchr81.20take_53
checkpointgaia_osMatchr81.20take_54
checkpointgaia_osMatchr81.20take_65
checkpointgaia_osMatchr81.20take_70
checkpointgaia_osMatchr81.20take_76
checkpointgaia_osMatchr81.20take_79
checkpointgaia_osMatchr81.20take_8
checkpointgaia_osMatchr81.20take_84
checkpointgaia_osMatchr81.20take_89
checkpointgaia_osMatchr81.20take_90
checkpointgaia_osMatchr81.20take_92
checkpointgaia_osMatchr81.20take_96
checkpointgaia_osMatchr81.20take_98
checkpointgaia_osMatchr81.20take_99
checkpointgaia_osMatchr82-
checkpointgaia_osMatchr82take_10
checkpointgaia_osMatchr82take_103
checkpointgaia_osMatchr82take_107
checkpointgaia_osMatchr82take_118
checkpointgaia_osMatchr82take_12
checkpointgaia_osMatchr82take_122
checkpointgaia_osMatchr82take_14
checkpointgaia_osMatchr82take_18
checkpointgaia_osMatchr82take_19
checkpointgaia_osMatchr82take_25
checkpointgaia_osMatchr82take_33
checkpointgaia_osMatchr82take_34
checkpointgaia_osMatchr82take_36
checkpointgaia_osMatchr82take_39
checkpointgaia_osMatchr82take_41
checkpointgaia_osMatchr82take_43
checkpointgaia_osMatchr82take_44
checkpointgaia_osMatchr82take_60
checkpointgaia_osMatchr82take_73
checkpointgaia_osMatchr82take_91
checkpointgaia_osMatchr82.10-
checkpointgaia_osMatchr82.10take_19
checkpointgaia_osMatchr82.10take_24
checkpointgaia_osMatchr82.10take_36
checkpointgaia_osMatchr82.10take_40
checkpointgaia_osMatchr82.10take_6
OR
checkpointquantum_3600Match-
checkpointquantum_3800Match-
checkpointquantum_force_19100Match-
checkpointquantum_force_19200Match-
checkpointquantum_force_29100Match-
checkpointquantum_force_29200Match-
checkpointquantum_force_3920Match-
checkpointquantum_force_3950Match-
checkpointquantum_force_3970Match-
checkpointquantum_force_3980Match-
checkpointquantum_force_9100Match-
checkpointquantum_force_9200Match-
checkpointquantum_force_9300Match-
checkpointquantum_force_9400Match-
checkpointquantum_force_9700Match-
checkpointquantum_force_9800Match-
checkpointquantum_lightspeed_mls200Match-
checkpointquantum_lightspeed_mls400Match-
checkpointquantum_lightspeed_qls250Match-
checkpointquantum_lightspeed_qls450Match-
checkpointquantum_lightspeed_qls650Match-
checkpointquantum_lightspeed_qls800Match-
[
  {
    "product": "Quantum Security Gateway",
    "vendor": "checkpoint",
    "versions": [
      {
        "status": "affected",
        "version": "R82.10 with Jumbo Hotfix Take 43 or below"
      },
      {
        "status": "affected",
        "version": "R82 with Jumbo Hotfix Take 125 or below"
      },
      {
        "status": "affected",
        "version": "R81.20 with Jumbo Hotfix Take 165 or below"
      }
    ]
  }
]

falconupkid

CheckPointwarnsofhackersexploitingSecurityGatewayVPNRCEflaw

KayleeWitherspoon

ActiveexploitationconfirmedonCheckPointVPNflaw(CVE-2026-85102)aheadofCISA'sSeptember25remediationdeadline

Sarunas

CheckPointManagement:CVE-2026-93616pathtraversal→scriptRCE(CVSS9.8)—zero-dayITW+CISAKEV

dcom-in

ActiveExploitationofCVE-2026-85102andaManagementPre-AuthenticationVulnerabilityCVE-2026-93616

_cybersecurity_

DutchNCSCwarnsofimminentexploitationofcriticalCheckPointVPNflaws

falconupkid

DutchNCSC:CriticalCheckPointVPNflawsexploitationisimminent

Sarunas

KIBERNETINIOSAUGUMORADAR-2026-09-12

dcom-in

VPNVulnerabilitiesCVE-2026-85102andCVE-2026-8510

siterightaway

CheckPoint’sSecurityNightmare:2CriticalBugsLeaveFirewallsExposed!

Djinjja-Ninja

CPLP-CheckPointLivePatch(sk185114)

Rows per page

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
23 Sep 2026 18:22Current
6.9Medium risk
Vulners AI Score6.9
CVSS 3.19.8
EPSS0.07546
SSVC
CWE-295In Wild
Quantum Security GatewayCheck Pointcertificate validationVPN negotiationunauthenticatedarbitrary code execution
138