CVE-2026-85102: Check Point Multiple Products Improper Certificate Validation Vulnerability
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Overview
Check Point Quantum Security Gateway and Spark Firewall contain an improper certificate validation flaw in their VPN negotiation handling. An unauthenticated remote attacker can present a crafted certificate during a Site-to-Site or Remote Access VPN handshake, bypassing validation and achieving remote code execution on the gateway. Affected versions span multiple release lines across Quantum Security Gateway and Gaia Embedded and Gaia OS. Active exploitation has been observed in the wild.
Vulnerability details
CWE-295 describes a failure to properly verify a certificate presented by a peer before trusting it. During VPN negotiation, the Security Gateway processes certificate data from the connecting party before any authentication is established. When that validation logic is defective, an attacker can supply a certificate with malformed or unexpected field values that the gateway accepts and processes incorrectly, reaching a code path that leads to arbitrary code execution. The flaw sits at the protocol boundary where the gateway is obligated to accept inbound certificate material from any peer attempting to establish a tunnel.
An attacker with network access to the VPN endpoint sends a crafted certificate during the IKE or SSL-VPN handshake. No credentials, prior session, or user interaction are required. Observed attacks originated from anonymization infrastructure and used certificates with subject fields such as CN=vpn,OU=users,O=global and similar patterns, indicating the attacker controls the certificate content submitted. Successful exploitation yields unauthenticated remote code execution on the gateway, with full confidentiality, integrity, and availability impact. Post-exploitation activity observed in the wild included internal port and service scanning originating from the compromised gateway.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review Mobile Access and VPN authentication logs for certificate-based login events where the certificate subject matches patterns such as CN=vpn, CN=vpn-user, or CN=vpnuser with OU=users and O=global. Check Point's advisory notes these are observed but not exhaustive attack indicators.
- Look for internal port and service scan activity originating from the gateway itself or from sessions established via Mobile Access with no corresponding legitimate user login event, as Check Point identifies this as common second-stage behavior following exploitation.
Remediation
Additional hardening
- For Quantum Security Gateway, apply Jumbo Hotfix Take 44 or later on R82.10, Take 126 or later on R82, and Take 166 or later on R81.20. For Gaia Embedded, upgrade to r81.10.17 or r82.00.10. See the vendor advisory in References for full build details.
- Restrict VPN endpoint exposure at the network perimeter: limit IKE and SSL-VPN port access to known peer IP ranges where Site-to-Site VPN is in use, reducing the attack surface for unauthenticated certificate submission.
- Audit Mobile Access and VPN logs for anomalous certificate subjects and session activity originating from unexpected sources, prioritizing sessions with no matching directory or authentication event.
- If patching cannot be applied immediately, consider disabling Remote Access VPN on gateways where it is not operationally required, leaving only Site-to-Site tunnels with tightly controlled peer lists.
Key dates
References
- https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
- https://support.checkpoint.com/results/sk/sk1000117
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-85102
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102
Frequently asked questions
Does CVE-2026-85102 affect my FedRAMP authorization?
If Check Point Multiple Products runs inside your authorization boundary, yes. CVE-2026-85102 is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of September 25, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is a finding. An overdue one is a finding your assessor and sponsoring agency can see right now. Your path forward is either remediation or formal documentation of the mitigation and the delay.
How does Knox help me handle CVE-2026-85102?
Knox does not patch your software. Remediating Check Point Multiple Products is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage that support documentation of the fix ahead of your next assessment. Applying the fix is yours to own; managing your compliance posture while you do it is not something you have to handle on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. When something like CVE-2026-85102 surfaces, exposure appears through ongoing monitoring rather than waiting for an assessor to flag it at a scheduled review.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-85102's remediation deadline of September 25, 2026 has passed. What happens now?
If CVE-2026-85102 remains unremediated, it is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult agency conversation. Closing it out and documenting the circumstances of the delay is what keeps your authorization clean and the agency relationship on solid footing.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
