CVE-2026-85102
Improper Certificate Validation in Quantum Security Gateway
At a glance Severity CRITICAL 9.8 Exploitation Known exploited (CISA KEV) · added 2026-09-22 Exploited per ENISA since 2026-09-22 EPSS EPSS 54.14 % · percentile 99 (2026-10-27) State PUBLISHED Published 2026-09-09 Updated 2026-09-23 Assigner checkpoint NVD status Analyzed Description Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Scores Version Score Vector Scored by CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H checkpoint CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · cve@checkpoint.com (Secondary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:o:checkpoint:gaia_embedded:*:*:*:*:*:*:*:* ≥ r81.10.00 < r81.10.17cpe:2.3:o:checkpoint:gaia_embedded:*:*:*:*:*:*:*:* ≥ r82.00.00 < r82.00.10cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:-:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004508:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004620:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004653:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004721:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004892:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004901:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004914:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004936:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:-:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998001559:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998001562:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002110:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002112:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002133:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002203:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002216:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002242:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002279:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:*:*:*:*:*:*:*:* ≥ r80 < r81.10cpe:2.3:o:checkpoint:gaia_os:r81.10:-:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_106:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_107:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_109:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_110:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_113:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_128:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_129:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_130:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_131:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_132:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_135:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_139:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_14:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_141:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_150:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_152:*:*:*:*:*:*cpe:2.3:o:checkpoint:gaia_os:r81.10:take_156:*:*:*:*:*:*+97 more Affected products Product Versions checkpoint · Quantum Security Gateway affected R82.10 with Jumbo Hotfix Take 43 or below ; affected R82 with Jumbo Hotfix Take 125 or below ; affected R81.20 with Jumbo Hotfix Take 165 or below
References
Sources
