CVE-2026-85102

Improper Certificate Validation in Quantum Security Gateway

Published Sep 9, 2026 CVSS 3.1 · 9.8 Critical EPSS 54.1% KEV · Listed
Description
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Checkpoint gaia Embedded
Checkpoint gaia Os
Checkpoint quantum 3600
Checkpoint quantum 3800
Checkpoint quantum Force 19100
Checkpoint quantum Force 19200
Checkpoint quantum Force 29100
Checkpoint quantum Force 29200
Checkpoint quantum Force 3920
Checkpoint quantum Force 3950
Checkpoint quantum Force 3970
Checkpoint quantum Force 3980
Checkpoint quantum Force 9100
Checkpoint quantum Force 9200
Checkpoint quantum Force 9300
Checkpoint quantum Force 9400
Checkpoint quantum Force 9700
Checkpoint quantum Force 9800
Checkpoint quantum Lightspeed Mls200
Checkpoint quantum Lightspeed Mls400
Checkpoint quantum Lightspeed Qls250
Checkpoint quantum Lightspeed Qls450
Checkpoint quantum Lightspeed Qls650
Checkpoint quantum Lightspeed Qls800
Checkpoint quantum Spark 1530
Checkpoint quantum Spark 1535
Checkpoint quantum Spark 1550
Checkpoint quantum Spark 1555
Checkpoint quantum Spark 1570
Checkpoint quantum Spark 1570r
Checkpoint quantum Spark 1575
Checkpoint quantum Spark 1575r
Checkpoint quantum Spark 1590
Checkpoint quantum Spark 1595
Checkpoint quantum Spark 1595r
Checkpoint quantum Spark 1600
Checkpoint quantum Spark 1800
Checkpoint quantum Spark 1900
Checkpoint quantum Spark 2000
Checkpoint quantum Spark 2530
Checkpoint quantum Spark 2550
Checkpoint quantum Spark 2560
Checkpoint quantum Spark 2570
Checkpoint quantum Spark 2580
Checkpoint quantum Spark 2590
CPEs cpe:2.3:h:checkpoint:quantum_3600:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_3800:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_force_19100:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_force_19200:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_force_29100:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_force_29200:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_force_3920:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_force_3950:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_force_3970:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_force_3980:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_force_9100:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_force_9200:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_force_9300:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_force_9400:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_force_9700:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_force_9800:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_lightspeed_mls200:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_lightspeed_mls400:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_lightspeed_qls250:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_lightspeed_qls450:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_lightspeed_qls650:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_lightspeed_qls800:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_1530:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_1535:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_1550:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_1555:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_1570:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_1570r:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_1575:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_1575r:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_1590:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_1595:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_1595r:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_1600:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_1800:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_1900:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_2000:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_2530:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_2550:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_2560:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_2570:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_2580:-:*:*:*:*:*:*:*
cpe:2.3:h:checkpoint:quantum_spark_2590:-:*:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:*:*:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:-:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004508:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004620:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004653:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004721:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004892:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004901:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004914:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004936:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:-:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998001559:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998001562:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002110:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002112:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002133:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002203:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002216:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002242:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002279:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:*:*:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:-:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_106:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_107:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_109:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_110:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_113:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_128:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_129:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_130:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_131:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_132:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_135:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_139:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_141:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_14:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_150:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_152:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_156:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_158:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_165:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_169:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_170:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_171:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_172:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_173:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_174:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_177:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_181:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_183:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_187:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_22:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_30:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_38:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_44:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_45:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_55:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_61:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_66:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_75:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_78:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_79:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_81:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_82:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_85:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_87:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_93:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_94:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_95:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.10:take_9:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:-:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_101:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_103:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_105:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_10:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_111:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_113:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_115:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_118:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_119:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_120:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_122:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_126:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_127:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_141:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_146:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_14:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_158:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_161:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_24:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_26:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_38:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_41:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_43:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_45:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_53:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_54:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_65:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_70:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_76:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_79:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_84:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_89:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_8:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_90:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_92:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_96:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_98:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r81.20:take_99:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82.10:-:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82.10:take_19:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82.10:take_24:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82.10:take_36:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82.10:take_40:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82.10:take_6:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:-:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_103:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_107:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_10:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_118:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_122:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_12:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_14:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_18:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_19:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_25:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_33:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_34:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_36:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_39:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_41:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_43:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_44:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_60:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_73:*:*:*:*:*:*
cpe:2.3:o:checkpoint:gaia_os:r82:take_91:*:*:*:*:*:*
Vendors & Products Checkpoint gaia Embedded
Checkpoint gaia Os
Checkpoint quantum 3600
Checkpoint quantum 3800
Checkpoint quantum Force 19100
Checkpoint quantum Force 19200
Checkpoint quantum Force 29100
Checkpoint quantum Force 29200
Checkpoint quantum Force 3920
Checkpoint quantum Force 3950
Checkpoint quantum Force 3970
Checkpoint quantum Force 3980
Checkpoint quantum Force 9100
Checkpoint quantum Force 9200
Checkpoint quantum Force 9300
Checkpoint quantum Force 9400
Checkpoint quantum Force 9700
Checkpoint quantum Force 9800
Checkpoint quantum Lightspeed Mls200
Checkpoint quantum Lightspeed Mls400
Checkpoint quantum Lightspeed Qls250
Checkpoint quantum Lightspeed Qls450
Checkpoint quantum Lightspeed Qls650
Checkpoint quantum Lightspeed Qls800
Checkpoint quantum Spark 1530
Checkpoint quantum Spark 1535
Checkpoint quantum Spark 1550
Checkpoint quantum Spark 1555
Checkpoint quantum Spark 1570
Checkpoint quantum Spark 1570r
Checkpoint quantum Spark 1575
Checkpoint quantum Spark 1575r
Checkpoint quantum Spark 1590
Checkpoint quantum Spark 1595
Checkpoint quantum Spark 1595r
Checkpoint quantum Spark 1600
Checkpoint quantum Spark 1800
Checkpoint quantum Spark 1900
Checkpoint quantum Spark 2000
Checkpoint quantum Spark 2530
Checkpoint quantum Spark 2550
Checkpoint quantum Spark 2560
Checkpoint quantum Spark 2570
Checkpoint quantum Spark 2580
Checkpoint quantum Spark 2590
Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-09-22T00:00:00+00:00', 'dueDate': '2026-09-25T00:00:00+00:00'}

Type Values Removed Values Added
First Time appeared Checkpoint
Checkpoint quantum Security Gateway
Vendors & Products Checkpoint
Checkpoint quantum Security Gateway
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Title Improper Certificate Validation in Quantum Security Gateway
Weaknesses CWE-295
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
checkpoint
Published
Updated
Sep 23, 2026, 3:55 AM
Reserved
Sep 3, 2026, 6:38 AM
Status
Analyzed
Published
Sep 9, 2026, 1:20 PM
Modified
Sep 23, 2026, 6:22 PM