CVE-2026-85102: critical vulnerability in Check Point VPNs, already being exploited

CVE-2026-85102: critical vulnerability in Check Point VPNs, already being exploited

In short

A critical vulnerability (CVE-2026-85102) has been confirmed in Check Point's Security Gateway, with a CVSS score of 9.8 out of 10 [1] and published on September 9, 2026 [1]. The flaw is included in the CISA KEV catalog of vulnerabilities with known exploitation [2], which means it is not a theoretical risk: it has already been used against real organizations. If your company uses Check Point equipment for remote access VPN or site-to-site connections, today's priority is to check whether you have vulnerable versions exposed and apply the vendor's patch without delay.

What it is and why it matters

The problem lies in improper validation of certificate trust during VPN connection negotiation [1]. In practice, this could allow a remote attacker, without needing credentials or prior authentication, to execute arbitrary code on the gateway itself [1]. In other words: there would be no need to steal a password or trick an employee—simply contacting the internet-exposed device would be enough to attempt to compromise it.

The combination of three factors is what raises the urgency: critical severity according to NVD [1], no authentication required [1], and confirmed presence in the CISA KEV list of actively exploited vulnerabilities [2]. VPN gateways are, by design, devices meant to be accessible from the internet, which makes them an especially attractive target when a flaw of this kind appears.

Who it affects

The affected vendor is Check Point [1], and the official description explicitly names the Quantum Security Gateway [1]. According to OCIRIA's radar analysis, this type of flaw in the VPN negotiation layer could also affect other devices in the same product family, such as the Spark firewall, since they share certificate management and VPN components [3]; this is OCIRIA's own risk assessment, not data directly confirmed by the vendor or by NVD, so we recommend treating it as a working hypothesis while the actual inventory is verified.

As for the type of organization at risk: any company using Check Point gateways for Site-to-Site VPN (connections between offices or with providers) or remote access VPN (telework) should consider itself potentially exposed until proven otherwise, given that both are the typical use scenarios for this type of equipment according to OCIRIA's analysis [3].

How to know if you are vulnerable

There is no simple way to "see it at a glance" from inside the office: you need to look from the outside, as an attacker would. The reasonable steps are:

1. Take inventory of which Check Point devices the organization has and what firmware version they run.

2. Check the internet-facing attack surface: which ports and VPN services are visible from outside the corporate network, since these are the entry point exploited by this type of flaw.

3. Review the certificate negotiation logs on the gateways, looking for anomalous connection attempts or unusual certificate rejections, since the flaw occurs precisely at that stage [3].

4. Cross-check the installed version against the official vendor advisory, which is the authoritative source for determining exactly which builds are affected.

How to protect your company

• Patch Check Point gateways and firewalls with top priority as soon as the vendor publishes or confirms the corresponding update; since it is listed in the CISA KEV catalog, this is a vulnerability that is already being exploited, not a preventive warning [2].
• Audit active VPN connections, both remote access and Site-to-Site, looking for sessions or source IPs you don't recognize [3].
• Review certificate logs from the past few days to detect possible exploitation attempts prior to patching [3].
• Reduce exposure while unpatched: if possible, temporarily restrict access to the VPN service to known IP ranges or enable additional layers of authentication.
• Document the inventory of all devices in the affected product family, including those OCIRIA's analysis flags as potentially related [3], to avoid leaving visibility gaps.

Frequently asked questions

Is this a vulnerability that is already being exploited?

Yes, it is included in the CISA KEV catalog, which specifically tracks vulnerabilities with known active exploitation [2].

How severe is it according to official standards?

Critical, with a CVSS score of 9.8 out of 10 [1].

Does it affect only the Security Gateway, or also other devices like the Spark firewall?

The vendor's official description mentions the Quantum Security Gateway [1]. According to OCIRIA's analysis, the Spark firewall could also be within scope since it shares VPN components [3], although this should be verified with the vendor itself before confirming or ruling out impact on that device.

Do I need to be a technical expert to understand if this affects me?

Not necessarily, but you do need to know what equipment you have and whether it is exposed to the internet; that inventory and that visibility are the first step, regardless of who within the company carries it out.

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-85102
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json
• [3] https://ociria.com