CVE-2026-85102

9.8 criticalKEVEPSS 54%

Critical (9.8) in Check Point Multiple Products. In CISA KEV since 2026-09-22. EPSS 54% chance of exploitation in the next 30 days.

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 54% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2026-09-22, due 2026-09-25
CWE: CWE-295
Published: 2026-09-09
Modified: 2026-09-23
Record from: the NVD, synced 2026-10-19

Affected

checkpoint:gaia_embedded
checkpoint:gaia_os

References

https://support.checkpoint.com/results/sk/sk1000117
https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102

Check your stack JSON