CVE-2026-85102: Check Point Quantum Gateway/Spark VPN Cert-Validation RCE (KEV)

CVE-2026-85102 is an unauthenticated, pre-authentication remote-code-execution vulnerability in Check Point Security Gateway and Spark Firewall caused by improper certificate validation during VPN negotiation, and Check Point itself has confirmed global exploitation attempts against Spark customers since mid-September 2026.

CVE-2026-85102 is a pre-authentication remote-code-execution vulnerability (CWE-295, improper certificate validation) in Check Point Security Gateway and Spark Firewall. NVD's description: "Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway" — an attacker who can present a crafted certificate during VPN negotiation, without needing any credentials, can run arbitrary code on the gateway itself (NVD).

Check Point's own CNA submission, which NVD stores as a Secondary (not NVD Primary) CVSS v3.1 score, independently agrees on 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low complexity, no privileges or user interaction required, full compromise of confidentiality, integrity and availability (NVD).

Check Point's own security-advisory blog post (published 2026-09-22, following the original 2026-09-09 disclosure) confirms active exploitation: "CVE-2026-85102 is a pre-authentication remote code execution vulnerability in Security Gateway's VPN certificate handling. Check Point disclosed the vulnerability and released fixes on September 9, 2026. At the time, we had no evidence of exploitation. We are now observing exploitation attempts against Check Point Spark customers globally." The post's own tracking table lists CVSS 9.8, affected products as Security Gateway and Spark Firewall (Centrally Managed / Locally Managed), affected releases R81 (EOS), R81.10 (EOS), R81.10.X, R81.20, R82, R82.00.X and R82.10, and fix reference SK1000117. It also documents the observed attack pattern directly: "Starting September 12, 2026, we observed a wave of exploitation attempts against Spark customers. The attempts originated from anonymization infrastructure, including VPN services and proxies," using certificate subjects such as CN=vpn,OU=users,O=global, and recommends reviewing logs for anomalous certificate-based Mobile Access logins and watching for follow-on internal port/service scanning (Check Point Security Advisory Blog).

This page does not independently cite Check Point's knowledge-base article SK1000117 (the fix reference named in both NVD and CISA KEV) because fetching it returns an HTTP 202 "challenge" response from an AWS WAF bot-check with no article content; the detail above instead comes from Check Point's own blog post, which was reachable and reported matching figures (CVSS 9.8, the same affected-release list) (Check Point SK1000117).

CISA added CVE-2026-85102 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-22, with a required-action due date of 2026-09-25 (3 days) (CISA KEV).

As of 2026-10-27, FIRST scores the probability of exploitation at 0.5414 (99.001th percentile) — very high, consistent with Check Point's own report of global exploitation attempts against internet-facing VPN gateways (FIRST EPSS).

Because this is an unauthenticated, pre-authentication RCE on internet-facing VPN gateways with confirmed global exploitation attempts, any Check Point Security Gateway or Spark Firewall on the affected releases above should install the SK1000117 fix immediately and review logs for the anomalous certificate subjects Check Point has published.

• Improper certificate trust validation during VPN negotiation (CWE-295) allows an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Gateway. — NVD
• CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, submitted directly by Check Point's own CNA and stored by NVD as a Secondary metric. — NVD
• Check Point confirms global exploitation attempts against Spark customers starting 2026-09-12, originating from VPN/proxy anonymization infrastructure using certificate subjects like CN=vpn,OU=users,O=global; fix available since 2026-09-09 (SK1000117); affected releases R81 (EOS) through R82.10. — Check Point Security Advisory Blog
• Check Point's knowledge-base article SK1000117 (the fix reference cited by NVD and CISA KEV) returns an HTTP 202 AWS-WAF bot-check challenge with no article content when fetched; no vendor detail is sourced to it beyond the URL itself. — Check Point SK1000117
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-22, required action due 2026-09-25. — CISA KEV
• EPSS score is 0.5414 (99.001th percentile) as of 2026-10-27. — FIRST EPSS