CVE-2026-85102
published 2026-09-09CVE-2026-85102: Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute…
PriorityP199critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2026-09-25
Exploited in the wild
EPSS
50.40%
98.9th percentile
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Affected
140 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | — | — |
| checkpoint | gaia_embedded | >= r81.10.00 < r81.10.17 | r81.10.17 |
| checkpoint | gaia_embedded | >= r82.00.00 < r82.00.10 | r82.00.10 |
| checkpoint | gaia_os | — | — |
| checkpoint | gaia_os | — | — |
| checkpoint | gaia_os | — | — |
| checkpoint | gaia_os | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Check Point Quantum Security Gateway VPN negotiation certificate validation
vuldb·2026-09-23·CVSS 9.8
CVE-2026-85102 [CRITICAL] Check Point Quantum Security Gateway VPN negotiation certificate validation
A vulnerability marked as problematic has been reported in Check Point Quantum Security Gateway. Affected by this issue is some unknown functionality of the component VPN negotiation. The manipulation leads to improper certificate validation.
This vulnerability is traded as CVE-2026-85102. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.
GHSA
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
ghsa_unreviewed·2026-09-09
CVE-2026-85102 [CRITICAL] CWE-295 Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
VulnCheck
Check Point Multiple Products Path Traversal Vulnerability
vulncheck·2026·CVSS 9.8
CVE-2026-93616 [CRITICAL] CWE-22 Check Point Multiple Products Path Traversal Vulnerability
Check Point Multiple Products Path Traversal Vulnerability
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.
Affected: Check Point Multiple Products
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet expos
VulnCheck
Check Point Multiple Products Improper Certificate Validation Vulnerability
vulncheck·2026·CVSS 9.8
CVE-2026-85102 [CRITICAL] CWE-295 Check Point Multiple Products Improper Certificate Validation Vulnerability
Check Point Multiple Products Improper Certificate Validation Vulnerability
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Affected: Check Point Multiple Products
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each as
CISA
Check Point Multiple Products Improper Certificate Validation Vulnerability
cisa·2026-09-22·CVSS 9.8
CVE-2026-85102 [CRITICAL] CWE-295 Check Point Multiple Products Improper Certificate Validation Vulnerability
Vulnerability: Check Point Multiple Products Improper Certificate Validation Vulnerability
Affected: Check Point Multiple Products
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Required Action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for eval
No detection rules found.
Nuclei
Check Point Security Management - Unauthenticated Directory Traversal to RCE
nuclei·CVSS 9.8
CVE-2026-93616 [CRITICAL] Check Point Security Management - Unauthenticated Directory Traversal to RCE
Check Point Security Management - Unauthenticated Directory Traversal to RCE
Check Point Management Server contains a directory traversal and unrestricted file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary scripts remotely, exploit requires no authentication.
Template:
id: CVE-2026-93616
info:
name: Check Point Security Management - Unauthenticated Directory Traversal to RCE
author: 0x_Akoko,pdteam
severity: critical
description: |
Check Point Management Server contains a directory traversal and unrestricted file upload vulnerability allowing unauthenticated attackers to upload and execute arbitrary scripts remotely, exploit requires no authentication.
impact: |
Unauthenticated attackers can upload and execute arbitrary scripts, leading to full
Hackernews
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
blogs_hackernews·2026-10-02·CVSS 9.8
CVE-2026-104286 [CRITICAL] Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added a critical security flaw impacting Fortinet FortiMail to its Known Exploited Vulnerabilities ( KEV ) catalog, following reports of active exploitation.
The vulnerability, tracked as CVE-2026-104286 (CVSS score: 9.8), allows unauthenticated attackers to write arbitrary files on the underlying system.
"An improper limitation of a pathname to a restricted directory ('path traversal') [CWE-22] and improper neutralization of NULL byte or NULL chara
Checkpoint
28th September – Threat Intelligence Report
blogs_checkpoint·2026-09-28
CVE-2026-85102 28th September – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 21
Android Malware 23
Artificial Intelligence 5
ChatGPT 3
Check Point Research Publications 474
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 426
How To Guides 13
Ransomware 6
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 175
Web 3.0 Security 11
Wipers 0
## 28th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th September, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
The FBI
Hackernews
⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
blogs_hackernews·2026-09-28·CVSS 9.8
CVE-2026-88771 [CRITICAL] ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: $387M Crypto Hack, Citrix Exploits, AI Agents Go Off-Script, and More Threats
A domain used as harmless placeholder text showed up in roughly 1,700 repositories. Then somebody registered it and started serving malicious lures. That is the kind of week this was: forgotten assumptions turning into live attack surface.
Elsewhere, weak service accounts, old bugs, exposed systems, phishing kits, and strangely easy exploit paths kept doing useful work for attackers. Nothing exotic. Mostly things nobody expected to matter anymore.
Here’s the full recap of what mattered this week.
## ⚡ Threat of the Week
Citrix
Hackernews
Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
blogs_hackernews·2026-09-22·CVSS 9.8
CVE-2026-93616 [CRITICAL] Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the company said .
The flaw, CVE-2026-93616 , allows an attacker who can access the server's web service to run scripts on it without logging in. Check Point released a fix on September 22 for the server that controls firewall policies for the Check Point gateways it manages.
Separately, Check Point said attackers have been trying since September 12 to exploit a VPN flaw it fixed on September 9 . The attempts, agai
Hackernews
⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
blogs_hackernews·2026-09-14
CVE-2026-85046 ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits
AI keeps showing up in the wrong places. Attackers are using it to speed up exploits, test defenses, and automate more of the job. Some models are also crossing lines on their own. That is not a great combination.
The rest of the week is more familiar: old bugs still working, fresh exploit chains, exposed systems, weak defaults, and simple paths that should have been harder to abuse. A few of these stories are clever. Most are just easy.
Here’s what mattered this week.
## ⚡ Threat of the Week
OpenAI Agents Behind May 2026 Attack o
Hackernews
Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE
blogs_hackernews·2026-09-10·CVSS 9.8
CVE-2026-85102 [CRITICAL] Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Check Point Discloses Two 9.8-Rated VPN Certificate Flaws Enabling Unauthenticated RCE
Check Point has patched two critical vulnerabilities in the way its firewall and management products handle VPN certificates. The company says both could allow an unauthenticated remote attacker to run code, but only "under specific conditions" that it has not described.
One flaw affects Check Point's Security Gateways, its firewall appliances. The other affects those gateways and the Security Management Server, the console used to configure them.
Check Point disclosed the flaws on September 9 in a notice to its customer community , and b
https://support.checkpoint.com/results/sk/sk1000117https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102
2026-09-09
Published
2026-09-22
Added to CISA KEV
Exploited in the wild