{"id":"CVE-2026-85102","title":"Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.","summary":"Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-295"],"vendor":"checkpoint","product":"gaia_embedded","affected":["gaia_embedded >= r81.10.00, < r81.10.17","gaia_embedded >= r82.00.00, < r82.00.10","gaia_embedded = r81.10.17","gaia_embedded = r82.00.10","gaia_os >= r80, < r81.10","gaia_os = r81.10","gaia_os = r81.20","gaia_os = r82","gaia_os = r82.10"],"patched":["gaia_embedded r82.00.10","gaia_os r81.10"],"published":"2026-09-09","updated":"2026-09-23","sourceUpdated":"2026-09-23T18:22:07.453","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-85102","references":[{"url":"https://support.checkpoint.com/results/sk/sk1000117","label":"cve@checkpoint.com"},{"url":"https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","kev","in-the-wild","cve.org","exploit-available"],"epss":0.5414,"epssPercentile":0.99001,"kev":true,"kevDateAdded":"2026-09-22","kevDueDate":"2026-09-25","kevRansomware":false,"exploited":true,"exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-22T19:40:15.351905Z"},"ingestedAt":"2026-09-14T14:05:09.307Z","exploits":{"github":1,"githubRepos":["https://github.com/aduli198/CVE-2026-85102"],"checkedAt":"2026-10-27T19:17:49.187Z"},"slug":"CVE-2026-85102","body":"## Overview\n\nImproper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.\n\n## Affected\n\n- `gaia_embedded >= r81.10.00, < r81.10.17`\n- `gaia_embedded >= r82.00.00, < r82.00.10`\n- `gaia_embedded = r81.10.17`\n- `gaia_embedded = r82.00.10`\n- `gaia_os >= r80, < r81.10`\n- `gaia_os = r81.10`\n- `gaia_os = r81.20`\n- `gaia_os = r82`\n- `gaia_os = r82.10`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `gaia_embedded r82.00.10`\n- `gaia_os r81.10`","depth":"hadal","depthScore":90,"depthScoreParts":{"impact":53.9,"likelihood":10.8,"exploitation":25,"ransomware":0},"changes":[{"seq":223930,"id":"CVE-2026-85102","ts":1792280033328,"field":"epss","old":"0.07546","new":"0.504"},{"seq":212725,"id":"CVE-2026-85102","ts":1790696247003,"field":"epss","old":"0.00988","new":"0.07546"},{"seq":209467,"id":"CVE-2026-85102","ts":1790140672261,"field":"kev","old":"false","new":"true"},{"seq":209368,"id":"CVE-2026-85102","ts":1790107892484,"field":"exploit_available","old":"false","new":"true"},{"seq":209367,"id":"CVE-2026-85102","ts":1790107892484,"field":"exploited","old":"false","new":"true"}]}