CVE-2026-85102KEV · OVERDUECWE-295

Check Point Multiple Products Improper Certificate Validation Vulnerability

Critical · published September 9, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.0th percentile for exploit probability.

30
days past CISA
deadline
CVSS v3.1
9.8
EPSS
54%
Percentile
99.0
In the wild
Confirmed
What it is

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.54230 · 99.0th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2026-09-09T17:20Z
KEV added
2026-09-22 · due 2026-09-25
Affected products (137)
ProductVersionsFixed in
checkpoint/gaia_embedded≥ r81.10.00, < r81.10.17r81.10.17
checkpoint/gaia_embedded≥ r82.00.00, < r82.00.10r82.00.10
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_embeddedall versions—
checkpoint/gaia_os≥ r80, < r81.10r81.10
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
checkpoint/gaia_osall versions—
References (3)
https://support.checkpoint.com/results/sk/sk1000117 · [email protected]https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/ · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 OCT 03:33Z
    EPSS moved 8% → 50%
    epss
  • 16 OCT 03:33Z
    EPSS moved 8% → 50%
    epss
  • 11 SEP 03:19Z
    EPSS moved — → 0%
    epss
  • 09 SEP 13:00Z
    Improper Certificate Validation in Quantum Security Gateway
    cvelistv5