InfraTrust report warns network management systems under attack
Active exploitation of critical Cisco and SonicWall management system vulnerabilities is a major trend, with attackers chaining flaws and deploying ransomware.
90
CVE-2026-85102
Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw
CISA: Check Point Multiple Products Improper Certificate Validation Vulnerability
- CVSS 3.1
- 9.8 critical
- EPSS
- 54%p99
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
CVE-2026-85102 is an improper certificate trust-validation flaw (CWE-295) in the VPN negotiation code of Check Point Quantum Security Gateways. An unauthenticated remote attacker who can reach the gateway's VPN service can trigger the flaw during VPN negotiation, where certificates involved in the exchange are not properly validated, and achieve code execution on the gateway. Successful exploitation yields arbitrary code execution on the gateway with high impact on confidentiality, integrity, and availability (CVSS 9.8), amounting to full compromise of the security gateway. The affected population is organizations running Quantum Security Gateways with VPN services reachable from untrusted networks. As of the available reporting there is no public proof-of-concept, the flaw is not in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation is confirmed; the issue was disclosed alongside a second, similarly rated (9.8) Check Point VPN certificate-validation RCE flaw.
What to do: Upgrade Quantum Security Gateways to the fixed versions listed in Check Point's advisory (AV26-902) as soon as they are published, prioritizing internet-facing VPN gateways. Until patched, restrict exposure of VPN negotiation endpoints to trusted networks and monitor VPN services for anomalous handshake activity. Inventory which gateways in your estate expose VPN services publicly and treat those as the highest-priority targets.
| Product | Affected |
|---|---|
| Check Point Quantum Security Gateway (VPN negotiation functionality) | — |
Estimated exposure
largetens of thousands of internet-exposed Quantum VPN gateways (est.); total Check Point installed base plausibly in the hundreds of thousands of appliances/sites — Estimate based on Check Point's position among the leading enterprise firewall vendors (a deployed base plausibly in the hundreds of thousands of appliances/sites) and typical internet-scan counts of exposed Check Point VPN endpoints on…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
KEVCISA Known Exploited Vulnerability
- Affected
- Check Point Multiple Products
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- checkpoint
- Products
- gaia embedded, gaia os
- Weakness
- CWE-295
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
20 storiesAttackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances
CISA adds four actively exploited zero-days to KEV, forcing immediate patching of critical flaws in Check Point, Arista, and F5 systems.
90
CISA Warns of Multiple Check Point Product Vulnerabilities Exploited in Attacks
CISA says two Check Point flaws, including unauthenticated remote code execution, are being exploited.
88
Hackers Exploit Critical Check Point VPN Flaws to Gain Remote Access Without Login
Check Point confirms active exploitation of two CVSS 9.8 VPN and management flaws enabling unauthenticated code execution.
88
CISA Warns of Check Point Vulnerabilities Exploited in Attacks (CVE-2026-85102 & CVE-2026-93616)
CISA says two critical Check Point VPN and management flaws are exploited in the wild.
88
Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
Check Point says attackers exploited unauthenticated Management Server zero-day CVE-2026-93616 in targeted July attacks.
88
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
CISA added exploited FortiMail flaw CVE-2026-104286, a critical unauthenticated file-write bug, to the KEV catalog.
86
CISA Adds Multiple Check Point Product Flaws to Exploited Vulnerabilities List
CISA added two actively exploited Check Point flaws, including unauthenticated VPN code execution, to KEV.
86
Check Point warns of hackers exploiting Security Gateway VPN RCE flaw
Check Point confirms active exploitation of pre-auth VPN RCE CVE-2026-85102 and zero-day CVE-2026-93616, now both in CISA KEV.
86
Check Point Patches Exploited Management Server Zero-Day
Check Point patched exploited zero-day CVE-2026-93616 in Management Server, and CISA added it and CVE-2026-85102 to KEV.
86
Check Point hacked: The security software protecting your network has become a prime attack target
Attackers are exploiting two pre-authentication Check Point firewall flaws rated CVSS 9.8.
85
Check Point Fixes a New Actively Exploited Critical Security Flaw
Check Point issued emergency hotfixes for actively exploited critical path traversal CVE-2026-93616 in Security Management Server.
85
Check Point Pre-Auth Flaws Under Attack
Check Point says two critical pre-authentication flaws, including CVE-2026-85102, are being actively exploited.
84
Check Point warns of Management Server zero-day exploited in attacks
Check Point patched CVE-2026-93616, an exploited unauthenticated Management Server zero-day.
84
U.S. CISA adds Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its Known Exploited Vulnerabilities catalog
CISA added four actively exploited Check Point, Arista VeloCloud Orchestrator, and F5 BIG-IP APM flaws to its KEV catalog, with federal fixes due September 25.
82
28th September – Threat Intelligence Report
Check Point's weekly report covers ShinyHunters' FBI jobs-site breach, Bitget's $351.6M wallet theft, and actively exploited critical RCEs in Check Point and F5 products.
80
Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents
Weekly roundup leads with a Gyazo breach of 23.6 million users and the TASK#STOMP document-stealing backdoor.
80
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited Check Point, Arista VeloCloud, and F5 BIG-IP flaws to the KEV catalog.
80
New Check Point flaw lets hackers execute code with root privileges
Check Point patched CVE-2026-91843, a stack-based buffer overflow in Security Management Server logins enabling unauthenticated root remote code execution.
80
2026-012: Critical Vulnerabilities in Check Point Products
Check Point issued emergency hotfixes for two CVSS 9.8 flaws (CVE-2026-85102, CVE-2026-85103) enabling unauthenticated RCE on VPN-enabled gateways.
80