Critical [CVE-2026-85102] Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway
This critical-severity Check Point advisory covers CVE-2026-85102 affecting Quantum Security Gateway, Spark Firewall (Locally Managed), Spark Firewall (Centrally Managed).
Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.
VulniPulse record published Record updated
Get an email when Check Point Quantum Gateway / Gaia publishes the next one.
See Check Point Quantum Gateway / Gaia's last 90 days of advisories first. Then choose the free weekly digest, or a free month of real-time alerts with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
Summary
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Affected products named by the advisory: Spark Firewall (Locally Managed); Spark Firewall (Centrally Managed).
CISA Known Exploited Vulnerability
- Listed:
- Sep 22, 2026 · federal remediation due Sep 25, 2026
- Required action:
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV is a prioritization signal from CISA. Remediation detail comes from the vendor advisory.
- Quantum Security Gateway R82.10 with Jumbo Hotfix Take 43 or below
- Quantum Security Gateway R82 with Jumbo Hotfix Take 125 or below
- Quantum Security Gateway R81.20 with Jumbo Hotfix Take 165 or below
Official advisory · high-confidence parse· fetched 20 days ago·verify at source
- R82.10 Jumbo Hotfix Accumulator Take 44 or later
- R82 Jumbo Hotfix Accumulator Take 126 or later
- R81.20 Jumbo Hotfix Accumulator Take 166 or later
- R81.10 Jumbo Hotfix Accumulator Take 190 or later
Official advisory · high-confidence parse· fetched 20 days ago·verify at source
Mitigation checklist
- This problem was fixed. Option 1: The fix is included in Check Point LivePatch Automatic installation If you have enabled automatic installation of Check Point LivePatch, the protection will be applied automatically. Manual installation Download the offline package from the table below: Version Take Number Download Package R82.10 BUNDLE_URGENT_SECURITY_UPDATE_R82_10_AUTOUPDATE take 26 (TAR) R82 BUNDLE_URGENT_SECURITY_UPDATE_R82_AUTOUPDATE take 26 (TAR) R81.20 BUNDLE_URGENT_SECURITY_UPDATE_R81_20_AUTOUPDATE take 26 (TAR) For instructions on the offline package installation procedure, refer to sk185114. To validate that LivePatch is properly installed and active, run the cpinfo -y CPupdates command on the Security Gateway / ClusterXL member in Expert mode and validate that you have BUNDLE_URGENT_SECURITY_UPDATE_R82_AUTOUPDATE Take 26 Example: [Expert@Host:0]# cpinfo -y CPupdates [CPUpdates] BUNDLE_URGENT_SECURITY_UPDATE_R82_AUTOUPDATE Take: 26 For LivePatch validation, run in Expert mode: On a Security Gateway / ClusterXL member: cplp list On a Scalable Platform Security Group: g_all cplp list Expected output: cpcert:cpca* CVE-2026-85102 CVE-2026-85103 cpcert:iked* CVE-2026-85102 CVE-2026-85103 cpcert:vpn* CVE-2026-85102 CVE-2026-85103 cpcert:vpnrad* CVE-2026-85102 CVE-2026-85103 cpcert_cprid:cprid* CVE-2026-85102 CVE-2026-85103 Option 2: The fix is also included in: Jumbo Hotfix Accumulator for R82.10 starting from Take 44 Jumbo Hotfix Accumulator for R82 starting from Take 126 Jumbo Hotfix Accumulator for R81.20 starting from Take 166 Jumbo Hotfix Accumulator for R81.10 starting from Take 190 Check Point Spark Firewalls R82.00.10 starting from Build 2325 Check Point Spark Firewalls R81.10.17 starting from Build 4968
Official advisory · high-confidence parse· fetched 20 days ago·verify at source
More Check Point advisories
- CVE-2026-85103Sep 9, 2026heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated
- CVE-2026-62145Jul 22, 2026vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only
- CVE-2026-50751Jun 8, 2026User Authentication Bypass in VPN Remote Access and Mobile Access
- CVE-2026-48135May 26, 2026Check Point HTTP-based service can incorrectly handle malformed HTTP requests
- CVE-2026-93616Sep 22, 2026directory traversal and file upload vulnerability allows an unauthenticated attacker
- CVE-2026-91843Sep 16, 2026Stack overflow in login process to the Security Management and Log Servers
Android app · Google Play
Monitor future Check Point CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.