Check Point Quantum Security Gateway Remote Code Execution (RCE) Vulnerability (CVE-2026-85102)

Affected Vendors

Check Point

Affected Components

Quantum Security Gateway, VPN Blade

Published Date

2026-09-09

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

All Check Point Quantum Security Gateway versions with VPN Blade enabled.

Impact

Unauthenticated remote attackers can execute arbitrary code with root privileges, leading to full gateway compromise.

Mitigation

Immediately apply the latest Jumbo Hotfix and enforce strict certificate validation policies.

Affected Products & Version Scope

Check Point Quantum Security Gateway (including R80.x and R81.x series) with VPN functionality active.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Apply Hotfix: Install the latest Jumbo Hotfix Accumulator as specified in Check Point advisory sk1000117.
IPS Protection: Ensure the IPS signature for 'VPN Certificate Validation Bypass' is set to 'Prevent'.
Access Control: Restrict VPN access to trusted IP ranges using firewall rules until the patch is fully deployed.

bash

# Verify hotfix installation status via CLI
cpinfo -y all | grep HOTFIX

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active exploitation, immediate patching is mandatory. If patching is not possible, disable the VPN service temporarily to mitigate the risk.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

This vulnerability arises from a failure in the certificate trust validation process (CWE-295) during VPN IKE negotiation. An attacker can bypass authentication by presenting a malformed certificate, leading to memory corruption or logic flaws that allow remote code execution. Given its inclusion in the CISA KEV catalog and a high EPSS score of 0.94, this vulnerability is being actively exploited in the wild to gain initial access to corporate networks.

Official Vendor Advisories & References

NVD Original English Description

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

https://support.checkpoint.com/results/sk/sk1000117

Source: cve@checkpoint.com · Mitigation, Patch, Vendor Advisory

https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: