CVE-2026-85102 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-09-09

Added to CISA KEV: 2026-09-22 13 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

IMMEDIATE (within hours): Apply Check Point hotfix patches — Jumbo Hotfix Take 44+ for R82.10, Take 126+ for R82, Take 166+ for R81.20. Refer to Check Point SK article sk1000117 for exact patch details and installation guidance.
IMMEDIATE: If patching is not immediately possible, consider temporarily restricting VPN endpoint exposure to known IP ranges or trusted source IPs via upstream ACLs or ISP-level filtering as a temporary mitigation — note this significantly impacts remote access functionality.
URGENT: Run Check Point's provided log hunting queries (from sk1000117 and the advisory blog post) to search for indicators of compromise, including anomalous VPN negotiation attempts, unexpected certificate validation failures, and unauthorized process execution on the gateway.
URGENT: Review gateway logs for unexpected outbound connections, new scheduled tasks, configuration changes, or evidence of lateral movement originating from the gateway into the internal network.
HIGH: Verify gateway integrity — check running processes, loaded modules, and firewall policy for unauthorized changes. A compromised gateway may have been used to install persistence mechanisms.
HIGH: Monitor threat intelligence feeds for emergence of public proof-of-concept exploit code, which would dramatically increase exploitation risk and urgency.
HIGH: If compromise is suspected, isolate the affected gateway and restore from known-good backup or factory image before redeployment — do not trust a potentially compromised security appliance.
ONGOING: Subscribe to Check Point security advisories for this CVE and related management interface vulnerability CVE-2026-93616 referenced in the advisory.
PATCH PRIORITY: CRITICAL — treat as emergency patch. Perimeter security appliances with pre-auth RCE at CVSS 9.8 in actively VPN-exposed context represent highest-priority patching targets.

🔍 Web Intelligence (Kagi · 2026-09-22)

Summary

CVE-2026-85102 is a critical security vulnerability (CVSS 9.8) affecting Check Point Quantum Security Gateways, specifically involving improper certificate trust validation during VPN negotiation. This flaw allows an unauthenticated remote attacker to bypass authentication mechanisms and execute arbitrary code on the affected Security Gateway. Given the nature of the device as a perimeter security component, this vulnerability is highly severe, as it provides attackers with a direct path to compromise network infrastructure and gain unauthorized access to internal resources.

Exploitation

Active Exploitation: While Check Point reported no initial evidence of exploitation at the time of disclosure, regional warnings from organizations like the Dutch NCSC have noted that exploitation is considered imminent.
Threat Actors/Campaigns: There are no specific threat actors or ransomware campaigns publicly attributed to this vulnerability at this time.
Proof-of-Concept/Tools: Proof-of-concept exploit code or automated attack tools have not been publicly detailed, though security research groups have characterized the flaw as a "one-day" exploitation risk due to the publicly available patch details.
Attack Prerequisites: The attack can be launched remotely over the network without requiring prior authentication or user interaction.

Affected Products & Patches

Affected Products: Check Point Quantum Security Gateways utilizing Remote Access and Site-to-Site VPN functionality.
Patch Availability: Security patches and hotfixes were officially released by Check Point on September 9, 2026.
Mitigations/Workarounds: Organizations are strongly advised to apply the provided patches immediately. Check Point has issued specific security advisories (e.g., sk1000117) providing guidance on remediation and log hunting queries to detect potential signs of compromise.

Impact

Access and Capabilities: Successful exploitation enables unauthenticated remote code execution, granting the attacker full control over the Security Gateway. This allows for total circumvention of security policies, interception of VPN traffic, and potential lateral movement into the internal network.
Business Risk: For internet-facing deployments, the risk is extreme, as these devices are typically the primary point of entry between the public internet and private corporate environments. Compromise of the Security Gateway effectively negates the security posture of the entire protected network, risking data breaches, persistent unauthorized access, and complete system takeover.