CVE-2026-85102
Check Point Multiple Products Improper Certificate Validation Vulnerability
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Deadline for federal agencies: 2026-09-25.
8 articles across 6 outlets · first covered Sep 9, 2026 · latest Sep 28, 2026
Associated threat actors
Coverage timeline
RSS-
Check Point Warns of Active Exploits and AI-Powered Attacksresearch.checkpoint.com · Sep 28, 2026
-
CISA Warns of Active Attacks on Check Point and F5 Flawssecurityaffairs.com · Sep 23, 2026
-
Check Point Patches Critical Flaw Exploited in Active Attackswww.securityweek.com · Sep 23, 2026
-
CISA Warns of Active Check Point Gateway Code Execution Flawcisa.gov · Sep 22, 2026
-
Attackers Target Check Point Gateways in Critical VPN Flawsecurityonline.info · Sep 22, 2026
-
Check Point Patches Critical VPN Vulnerabilitieswww.securityweek.com · Sep 11, 2026
-
Check Point Fixes Critical VPN Flaws Enabling Unauthenticated Code Executionthehackernews.com · Sep 10, 2026
-
Check Point Patches Critical VPN Flaws Enabling Remote Code Executionsecurityonline.info · Sep 9, 2026