Skip to main content
Apexward Pulse

Check Point

Check Point Multiple Products Certificate Validation Flaw Vulnerability

CVE-2026-85102

What this means

This is rated critical severity (9.8 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Checkpoint Gaia Embedded, Checkpoint Quantum Spark 1530 and Checkpoint Quantum Spark 1535, and 18 more are in your estate, and treat that as the priority.

Full vendor description

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

Scoring and exploitation

9.8/ 10
CVSS 3.1 base scoreCritical

Exploitable over the network without any account, and no one has to click or open anything. High impact on confidentiality, integrity and availability.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionNoneUI:N
ScopeUnchangedS:U

Impact

Longer bar: more harm

ConfidentialityHighC:H
IntegrityHighI:H
AvailabilityHighA:H
Elevated attack likelihood (~54.1% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
Check Point Multiple Products

Weaknesses

CWE-295

Affected products ()

  • Checkpoint Gaia Embedded
  • Checkpoint Quantum Spark 1530
  • Checkpoint Quantum Spark 1535
  • Checkpoint Quantum Spark 1550
  • Checkpoint Quantum Spark 1555
  • Checkpoint Quantum Spark 1570
  • Checkpoint Quantum Spark 1570r
  • Checkpoint Quantum Spark 1575
  • Checkpoint Quantum Spark 1575r
  • Checkpoint Quantum Spark 1590
  • Checkpoint Quantum Spark 1595
  • Checkpoint Quantum Spark 1595r
  • Checkpoint Quantum Spark 1600
  • Checkpoint Quantum Spark 1800
  • Checkpoint Quantum Spark 1900
  • Checkpoint Quantum Spark 2000
  • Checkpoint Quantum Spark 2530
  • Checkpoint Quantum Spark 2550
  • Checkpoint Quantum Spark 2560
  • Checkpoint Quantum Spark 2570
  • Checkpoint Quantum Spark 2580
Show the raw CPE strings (40)
  • cpe:2.3:o:checkpoint:gaia_embedded:*:*:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:-:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004508:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004620:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004653:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004721:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004892:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004901:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004914:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r81.10.17:build_996004936:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:-:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998001559:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998001562:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002110:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002112:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002133:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002203:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002216:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002242:*:*:*:*:*:*
  • cpe:2.3:o:checkpoint:gaia_embedded:r82.00.10:build_998002279:*:*:*:*:*:*
  • cpe:2.3:h:checkpoint:quantum_spark_1530:-:*:*:*:*:*:*:*
  • cpe:2.3:h:checkpoint:quantum_spark_1535:-:*:*:*:*:*:*:*
  • cpe:2.3:h:checkpoint:quantum_spark_1550:-:*:*:*:*:*:*:*
  • cpe:2.3:h:checkpoint:quantum_spark_1555:-:*:*:*:*:*:*:*
  • cpe:2.3:h:checkpoint:quantum_spark_1570:-:*:*:*:*:*:*:*

Showing 25 of 40 matches from .

References

3 links from the CVE record, grouped by site; the vendor's advisory comes first.

Related feed events

  • Check Point Multiple Products Certificate Validation Flaw Vulnerability

    Type Vulnerability

    CVE-2026-85102 has an estimated attack likelihood score of 0.504 (~50.4% estimated chance of exploitation in the next 30 days; 98.9th percentile) as of 2026-10-15.

    Next step: Confirm whether Check Point is in your estate.

    Who's reporting

    1 of 3 perspectives

    Official authority: Official 1Vendor statement missing. no VendorResearcher coverage missing. no Researcher1 signal

    Only official coverage so far. Treat as an early signal.

    Check Point
    CVE-2026-85102