CVE-2026-85103

Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding

At a glance

Severity: CRITICAL 9.8
Exploitation: Exploited per ENISA since 2026-09-25
EPSS: EPSS 4.29 % · percentile 91 (2026-10-27)
State: PUBLISHED
Published: 2026-09-09
Updated: 2026-09-10
Assigner: checkpoint
NVD status: Awaiting Analysis

Description

A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	checkpoint
CVSS 3.1	CRITICAL 9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	NVD · cve@checkpoint.com (Secondary)

Weaknesses (CWE)

CWE-122

European references

ENISA EUVD · EUVD-2026-75010
GCVE · GCVE-0-2026-85103

CERT-FR advisories

CERTFR-2026-AVI-1152 — Multiples vulnérabilités dans les produits Check Point · cert.ssi.gouv.fr

Affected products

Product	Versions
checkpoint · Quantum Security Gateway	affected R82.10 with Jumbo Hotfix Take 43 or below ; affected R82 with Jumbo Hotfix Take 125 or below ; affected R81.20 with Jumbo Hotfix Take 165 or below
checkpoint · Quantum Security Management	affected R82.10 with Jumbo Hotfix Take 43 or below ; affected R82 with Jumbo Hotfix Take 125 or below ; affected R81.20 with Jumbo Hotfix Take 165 or below

References

https://support.checkpoint.com/results/sk/sk1000118

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD