CVE-2026-85102 | defend.network

What is CVE-2026-85102?

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

CVSS9.8 NVD 3.1

SeverityCRITICAL

ExploitationNo exploitation reported

EPSS<1% · P26

Triage statusNo Known Exploit

ActionPatch within 48 hours

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWECWE-295

NVD published2026-09-09

NVD last modified2026-09-10

Timeline

2026-09-09Published to the U.S. National Vulnerability Database (NVD)
2026-09-10NVD record last updated
2026-09-14First covered in a defend.network daily briefing

Affected product

See advisory

Remediation Steps

Apply Check Point security patch for critical VPN flaw
Verify patch deployment across all VPN endpoints
Monitor VPN logs for suspicious authentication or connection patterns
Implement additional authentication controls if patching is delayed

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 2 of September 2026 (September 14 – 20)
Check Point VPN & Tencent flaws in active exploitation; RubyGems RCE confirmed (2026-09-14)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.