CVE-2026-85102Critical· 9.8▾ Hadal⚠ Exploited in the wildPoC availableImproper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
▾ Hadal zone — Critical and actively exploited (CISA KEV / 0day)
impact 53.9 · likelihood 10.8 · exploitation 25
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Federal remediation due Sep 25, 2026
1 GitHub repo
Last analysed / modified upstream
0.3% → 54%
Added to the CISA catalog on Sep 22, 2026. Federal remediation due Sep 25, 2026. View catalog ↗
Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
gaia_embedded >= r81.10.00, < r81.10.17gaia_embedded >= r82.00.00, < r82.00.10gaia_embedded = r81.10.17gaia_embedded = r82.00.10gaia_os >= r80, < r81.10gaia_os = r81.10gaia_os = r81.20gaia_os = r82gaia_os = r82.10Upgrade past the affected range:
gaia_embedded r82.00.10gaia_os r81.10Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-93616Critical· 9.8A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.
CVE-2024-24919High· 8.6Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades
CVE-2026-16232Critical· 9.1An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges
CVE-2026-91843Critical· 9.8A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges.
CVE-2026-106072Medium· 6.7nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification (CVE-2026-106072)
CVE-2026-105483High· 7.4nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483)