Vulnerability-Lookup

WID-SEC-W-2026-3305

Vulnerability from csaf_certbund - Published: 2026-09-09 22:00 - Updated: 2026-09-22 22:00

Summary

Check Point Security Gateway, Spark Firewall und Security Management: Mehrere Schwachstellen ermöglichen Codeausführung

Severity

Kritisch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Check Point Security Gateway ist eine "Next Generation Firewall" Produktfamilie. Die Check Point Spark Firewall ist ein All-in-One-Cybersicherheits-Gateway. Eine vereinheitlichte Plattform zur Verwaltung von Sicherheitsrichtlinien, Überwachung des Netzwerkverkehrs und Bereitstellung von Sicherheits-Gateways in der Infrastruktur einer Organisation.

Angriff: Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Check Point Security Gateway, Check Point Spark Firewall und Check Point Security Management ausnutzen, um beliebigen Programmcode auszuführen.

Betroffene Betriebssysteme: - Appliance - Windows

CVE-2026-85102

Affected products

Known affected 23 products

Product	Identifier	Version	Remediation
Check Point Security Management Server R82 <Jumbo Hotfix Take 126 Check Point / Security Management		Server R82 <Jumbo Hotfix Take 126
Check Point Spark Firewall R81.20 <Take 24 Check Point / Spark Firewall		R81.20 <Take 24
Check Point Security Gateway R82 <Jumbo Hotfix Take 126 Check Point / Security Gateway		R82 <Jumbo Hotfix Take 126
Check Point Spark Firewall R82 <Jumbo Hotfix Take 126 Check Point / Spark Firewall		R82 <Jumbo Hotfix Take 126
Check Point Spark Firewall R82.10 <Take 26 Check Point / Spark Firewall		R82.10 <Take 26
Check Point Security Management Server R81.20 <Jumbo Hotfix Take 166 Check Point / Security Management		Server R81.20 <Jumbo Hotfix Take 166
Check Point Security Gateway R81.20 <Jumbo Hotfix Take 166 Check Point / Security Gateway		R81.20 <Jumbo Hotfix Take 166
Check Point Security Gateway R82.10 <Take 24 Check Point / Security Gateway		R82.10 <Take 24
Check Point Spark Firewall R82.00.10 <Build 2325 Check Point / Spark Firewall		R82.00.10 <Build 2325
Check Point Spark Firewall R81.20 <Take 26 Check Point / Spark Firewall		R81.20 <Take 26
Check Point Spark Firewall R81.20 <Jumbo Hotfix Take 166 Check Point / Spark Firewall		R81.20 <Jumbo Hotfix Take 166
Check Point Spark Firewall R82 <Take 26 Check Point / Spark Firewall		R82 <Take 26
Check Point Security Gateway R81.20 <Take 24 Check Point / Security Gateway		R81.20 <Take 24
Check Point Security Gateway R82.10 <Jumbo Hotfix Take 44 Check Point / Security Gateway		R82.10 <Jumbo Hotfix Take 44
Check Point Security Gateway R82 <Take 26 Check Point / Security Gateway		R82 <Take 26
Check Point Security Gateway R82 <Take 24 Check Point / Security Gateway		R82 <Take 24
Check Point Spark Firewall R81.10.17 <Build 4968 Check Point / Spark Firewall		R81.10.17 <Build 4968
Check Point Security Gateway R82.10 <Take 26 Check Point / Security Gateway		R82.10 <Take 26
Check Point Spark Firewall R82 <Take 24 Check Point / Spark Firewall		R82 <Take 24
Check Point Spark Firewall R82.10 <Jumbo Hotfix Take 44 Check Point / Spark Firewall		R82.10 <Jumbo Hotfix Take 44
Check Point Spark Firewall R82.10 <Take 24 Check Point / Spark Firewall		R82.10 <Take 24
Check Point Security Management Server R82.10 <Jumbo Hotfix Take 44 Check Point / Security Management		Server R82.10 <Jumbo Hotfix Take 44
Check Point Security Gateway R81.20 <Take 26 Check Point / Security Gateway		R81.20 <Take 26

CVE-2026-85103

Affected products

Known affected 26 products

Product	Identifier	Version	Remediation
Check Point Security Management Server R82.10 <Take 24 Check Point / Security Management		Server R82.10 <Take 24
Check Point Spark Firewall R81.20 <Take 24 Check Point / Spark Firewall		R81.20 <Take 24
Check Point Security Management Server R81.20 <Take 24 Check Point / Security Management		Server R81.20 <Take 24
Check Point Security Management Server R82 <Take 24 Check Point / Security Management		Server R82 <Take 24
Check Point Spark Firewall R82.10 <Take 26 Check Point / Spark Firewall		R82.10 <Take 26
Check Point Security Management Server R81.20 <Jumbo Hotfix Take 166 Check Point / Security Management		Server R81.20 <Jumbo Hotfix Take 166
Check Point Security Gateway R81.20 <Jumbo Hotfix Take 166 Check Point / Security Gateway		R81.20 <Jumbo Hotfix Take 166
Check Point Security Gateway R82.10 <Take 24 Check Point / Security Gateway		R82.10 <Take 24
Check Point Spark Firewall R82.00.10 <Build 2325 Check Point / Spark Firewall		R82.00.10 <Build 2325
Check Point Spark Firewall R81.20 <Jumbo Hotfix Take 166 Check Point / Spark Firewall		R81.20 <Jumbo Hotfix Take 166
Check Point Security Gateway R81.20 <Take 24 Check Point / Security Gateway		R81.20 <Take 24
Check Point Security Gateway R82 <Take 24 Check Point / Security Gateway		R82 <Take 24
Check Point Spark Firewall R81.10.17 <Build 4968 Check Point / Spark Firewall		R81.10.17 <Build 4968
Check Point Spark Firewall R82 <Take 24 Check Point / Spark Firewall		R82 <Take 24
Check Point Spark Firewall R82.10 <Take 24 Check Point / Spark Firewall		R82.10 <Take 24
Check Point Security Management Server R82 <Jumbo Hotfix Take 126 Check Point / Security Management		Server R82 <Jumbo Hotfix Take 126
Check Point Security Gateway R82 <Jumbo Hotfix Take 126 Check Point / Security Gateway		R82 <Jumbo Hotfix Take 126
Check Point Spark Firewall R82 <Jumbo Hotfix Take 126 Check Point / Spark Firewall		R82 <Jumbo Hotfix Take 126
Check Point Spark Firewall R81.20 <Take 26 Check Point / Spark Firewall		R81.20 <Take 26
Check Point Spark Firewall R82 <Take 26 Check Point / Spark Firewall		R82 <Take 26
Check Point Security Gateway R82 <Take 26 Check Point / Security Gateway		R82 <Take 26
Check Point Security Gateway R82.10 <Jumbo Hotfix Take 44 Check Point / Security Gateway		R82.10 <Jumbo Hotfix Take 44
Check Point Security Gateway R82.10 <Take 26 Check Point / Security Gateway		R82.10 <Take 26
Check Point Spark Firewall R82.10 <Jumbo Hotfix Take 44 Check Point / Spark Firewall		R82.10 <Jumbo Hotfix Take 44
Check Point Security Gateway R81.20 <Take 26 Check Point / Security Gateway		R81.20 <Take 26
Check Point Security Management Server R82.10 <Jumbo Hotfix Take 44 Check Point / Security Management		Server R82.10 <Jumbo Hotfix Take 44

References

5 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://support.checkpoint.com/results/sk/sk1000117	external
https://support.checkpoint.com/results/sk/sk1000118	external
https://blog.checkpoint.com/security/security-adv…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "kritisch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Check Point Security Gateway ist eine \"Next Generation Firewall\" Produktfamilie.\r\nDie Check Point Spark Firewall ist ein All-in-One-Cybersicherheits-Gateway.\r\nEine vereinheitlichte Plattform zur Verwaltung von Sicherheitsrichtlinien, \u00dcberwachung des Netzwerkverkehrs und Bereitstellung von Sicherheits-Gateways in der Infrastruktur einer Organisation.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Check Point Security Gateway, Check Point Spark Firewall und Check Point Security Management ausnutzen, um beliebigen Programmcode auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Appliance\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-3305 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3305.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-3305 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3305"
      },
      {
        "category": "external",
        "summary": "Checkpoint Security Advisory vom 2026-09-09",
        "url": "https://support.checkpoint.com/results/sk/sk1000117"
      },
      {
        "category": "external",
        "summary": "Checkpoint Security Advisory vom 2026-09-09",
        "url": "https://support.checkpoint.com/results/sk/sk1000118"
      },
      {
        "category": "external",
        "summary": "Exploit",
        "url": "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/amp/"
      }
    ],
    "source_lang": "en-US",
    "title": "Check Point Security Gateway, Spark Firewall und Security Management: Mehrere Schwachstellen erm\u00f6glichen Codeausf\u00fchrung",
    "tracking": {
      "current_release_date": "2026-09-22T22:00:00.000+00:00",
      "generator": {
        "date": "2026-09-23T07:04:28.172+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-3305",
      "initial_release_date": "2026-09-09T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-09-09T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-09-13T22:00:00.000+00:00",
          "number": "2",
          "summary": "Weitere gefixte Versionen erg\u00e4nzt"
        },
        {
          "date": "2026-09-22T22:00:00.000+00:00",
          "number": "3",
          "summary": "Exploit CVE-2026-85102"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "R82.10 \u003cTake 24",
                "product": {
                  "name": "Check Point Security Gateway R82.10 \u003cTake 24",
                  "product_id": "T059300"
                }
              },
              {
                "category": "product_version",
                "name": "R82.10 Take 24",
                "product": {
                  "name": "Check Point Security Gateway R82.10 Take 24",
                  "product_id": "T059300-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:checkpoint:security_gateway:r82.10__take_24"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R82 \u003cTake 24",
                "product": {
                  "name": "Check Point Security Gateway R82 \u003cTake 24",
                  "product_id": "T059301"
                }
              },
              {
                "category": "product_version",
                "name": "R82 Take 24",
                "product": {
                  "name": "Check Point Security Gateway R82 Take 24",
                  "product_id": "T059301-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:checkpoint:security_gateway:r82__take_24"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R81.20 \u003cTake 24",
                "product": {
                  "name": "Check Point Security Gateway R81.20 \u003cTake 24",
                  "product_id": "T059302"
                }
              },
              {
                "category": "product_version",
                "name": "R81.20 Take 24",
                "product": {
                  "name": "Check Point Security Gateway R81.20 Take 24",
                  "product_id": "T059302-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:checkpoint:security_gateway:r81.20__take_24"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R82.10 \u003cJumbo Hotfix Take 44",
                "product": {
                  "name": "Check Point Security Gateway R82.10 \u003cJumbo Hotfix Take 44",
                  "product_id": "T059434"
                }
              },
              {
                "category": "product_version",
                "name": "R82.10 Jumbo Hotfix Take 44",
                "product": {
                  "name": "Check Point Security Gateway R82.10 Jumbo Hotfix Take 44",
                  "product_id": "T059434-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:checkpoint:security_gateway:r82.10__jumbo_hotfix_take_44"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R82 \u003cJumbo Hotfix Take 126",
                "product": {
                  "name": "Check Point Security Gateway R82 \u003cJumbo Hotfix Take 126",
                  "product_id": "T059437"
                }
              },
              {
                "category": "product_version",
                "name": "R82 Jumbo Hotfix Take 126",
                "product": {
                  "name": "Check Point Security Gateway R82 Jumbo Hotfix Take 126",
                  "product_id": "T059437-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:checkpoint:security_gateway:r82__jumbo_hotfix_take_126"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R81.20 \u003cJumbo Hotfix Take 166",
                "product": {
                  "name": "Check Point Security Gateway R81.20 \u003cJumbo Hotfix Take 166",
                  "product_id": "T059440"
                }
              },
              {
                "category": "product_version",
                "name": "R81.20 Jumbo Hotfix Take 166",
                "product": {
                  "name": "Check Point Security Gateway R81.20 Jumbo Hotfix Take 166",
                  "product_id": "T059440-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:checkpoint:security_gateway:r81.20__jumbo_hotfix_take_166"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R82.10 \u003cTake 26",
                "product": {
                  "name": "Check Point Security Gateway R82.10 \u003cTake 26",
                  "product_id": "T059972"
                }
              },
              {
                "category": "product_version",
                "name": "R82.10 Take 26",
                "product": {
                  "name": "Check Point Security Gateway R82.10 Take 26",
                  "product_id": "T059972-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:checkpoint:security_gateway:r82.10__take_26"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R82 \u003cTake 26",
                "product": {
                  "name": "Check Point Security Gateway R82 \u003cTake 26",
                  "product_id": "T059973"
                }
              },
              {
                "category": "product_version",
                "name": "R82 Take 26",
                "product": {
                  "name": "Check Point Security Gateway R82 Take 26",
                  "product_id": "T059973-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:checkpoint:security_gateway:r82__take_26"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R81.20 \u003cTake 26",
                "product": {
                  "name": "Check Point Security Gateway R81.20 \u003cTake 26",
                  "product_id": "T059974"
                }
              },
              {
                "category": "product_version",
                "name": "R81.20 Take 26",
                "product": {
                  "name": "Check Point Security Gateway R81.20 Take 26",
                  "product_id": "T059974-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:checkpoint:security_gateway:r81.20__take_26"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Security Gateway"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Server R82.10 \u003cTake 24",
                "product": {
                  "name": "Check Point Security Management Server R82.10 \u003cTake 24",
                  "product_id": "T059306"
                }
              },
              {
                "category": "product_version",
                "name": "Server R82.10 Take 24",
                "product": {
                  "name": "Check Point Security Management Server R82.10 Take 24",
                  "product_id": "T059306-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:security_management:server_r82.10__take_24"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Server R82 \u003cTake 24",
                "product": {
                  "name": "Check Point Security Management Server R82 \u003cTake 24",
                  "product_id": "T059307"
                }
              },
              {
                "category": "product_version",
                "name": "Server R82 Take 24",
                "product": {
                  "name": "Check Point Security Management Server R82 Take 24",
                  "product_id": "T059307-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:security_management:server_r82__take_24"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Server R81.20 \u003cTake 24",
                "product": {
                  "name": "Check Point Security Management Server R81.20 \u003cTake 24",
                  "product_id": "T059308"
                }
              },
              {
                "category": "product_version",
                "name": "Server R81.20 Take 24",
                "product": {
                  "name": "Check Point Security Management Server R81.20 Take 24",
                  "product_id": "T059308-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:security_management:server_r81.20__take_24"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Server R82.10 \u003cJumbo Hotfix Take 44",
                "product": {
                  "name": "Check Point Security Management Server R82.10 \u003cJumbo Hotfix Take 44",
                  "product_id": "T059435"
                }
              },
              {
                "category": "product_version",
                "name": "Server R82.10 Jumbo Hotfix Take 44",
                "product": {
                  "name": "Check Point Security Management Server R82.10 Jumbo Hotfix Take 44",
                  "product_id": "T059435-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:security_management:server_r82.10__jumbo_hotfix_take_44"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Server R82 \u003cJumbo Hotfix Take 126",
                "product": {
                  "name": "Check Point Security Management Server R82 \u003cJumbo Hotfix Take 126",
                  "product_id": "T059438"
                }
              },
              {
                "category": "product_version",
                "name": "Server R82 Jumbo Hotfix Take 126",
                "product": {
                  "name": "Check Point Security Management Server R82 Jumbo Hotfix Take 126",
                  "product_id": "T059438-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:security_management:server_r82__jumbo_hotfix_take_126"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Server R81.20 \u003cJumbo Hotfix Take 166",
                "product": {
                  "name": "Check Point Security Management Server R81.20 \u003cJumbo Hotfix Take 166",
                  "product_id": "T059441"
                }
              },
              {
                "category": "product_version",
                "name": "Server R81.20 Jumbo Hotfix Take 166",
                "product": {
                  "name": "Check Point Security Management Server R81.20 Jumbo Hotfix Take 166",
                  "product_id": "T059441-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:security_management:server_r81.20__jumbo_hotfix_take_166"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Security Management"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "R82.10 \u003cTake 24",
                "product": {
                  "name": "Check Point Spark Firewall R82.10 \u003cTake 24",
                  "product_id": "T059303"
                }
              },
              {
                "category": "product_version",
                "name": "R82.10 Take 24",
                "product": {
                  "name": "Check Point Spark Firewall R82.10 Take 24",
                  "product_id": "T059303-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:spark_firewall:r82.10__take_24"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R82 \u003cTake 24",
                "product": {
                  "name": "Check Point Spark Firewall R82 \u003cTake 24",
                  "product_id": "T059304"
                }
              },
              {
                "category": "product_version",
                "name": "R82 Take 24",
                "product": {
                  "name": "Check Point Spark Firewall R82 Take 24",
                  "product_id": "T059304-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:spark_firewall:r82__take_24"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R81.20 \u003cTake 24",
                "product": {
                  "name": "Check Point Spark Firewall R81.20 \u003cTake 24",
                  "product_id": "T059305"
                }
              },
              {
                "category": "product_version",
                "name": "R81.20 Take 24",
                "product": {
                  "name": "Check Point Spark Firewall R81.20 Take 24",
                  "product_id": "T059305-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:spark_firewall:r81.20__take_24"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R82.10 \u003cJumbo Hotfix Take 44",
                "product": {
                  "name": "Check Point Spark Firewall R82.10 \u003cJumbo Hotfix Take 44",
                  "product_id": "T059436"
                }
              },
              {
                "category": "product_version",
                "name": "R82.10 Jumbo Hotfix Take 44",
                "product": {
                  "name": "Check Point Spark Firewall R82.10 Jumbo Hotfix Take 44",
                  "product_id": "T059436-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:spark_firewall:r82.10__jumbo_hotfix_take_44"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R82 \u003cJumbo Hotfix Take 126",
                "product": {
                  "name": "Check Point Spark Firewall R82 \u003cJumbo Hotfix Take 126",
                  "product_id": "T059439"
                }
              },
              {
                "category": "product_version",
                "name": "R82 Jumbo Hotfix Take 126",
                "product": {
                  "name": "Check Point Spark Firewall R82 Jumbo Hotfix Take 126",
                  "product_id": "T059439-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:spark_firewall:r82__jumbo_hotfix_take_126"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R81.20 \u003cJumbo Hotfix Take 166",
                "product": {
                  "name": "Check Point Spark Firewall R81.20 \u003cJumbo Hotfix Take 166",
                  "product_id": "T059442"
                }
              },
              {
                "category": "product_version",
                "name": "R81.20 Jumbo Hotfix Take 166",
                "product": {
                  "name": "Check Point Spark Firewall R81.20 Jumbo Hotfix Take 166",
                  "product_id": "T059442-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:spark_firewall:r81.20__jumbo_hotfix_take_166"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R82.00.10 \u003cBuild 2325",
                "product": {
                  "name": "Check Point Spark Firewall R82.00.10 \u003cBuild 2325",
                  "product_id": "T059443"
                }
              },
              {
                "category": "product_version",
                "name": "R82.00.10 Build 2325",
                "product": {
                  "name": "Check Point Spark Firewall R82.00.10 Build 2325",
                  "product_id": "T059443-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:spark_firewall:r82.00.10__build_2325"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R81.10.17 \u003cBuild 4968",
                "product": {
                  "name": "Check Point Spark Firewall R81.10.17 \u003cBuild 4968",
                  "product_id": "T059444"
                }
              },
              {
                "category": "product_version",
                "name": "R81.10.17 Build 4968",
                "product": {
                  "name": "Check Point Spark Firewall R81.10.17 Build 4968",
                  "product_id": "T059444-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:spark_firewall:r81.10.17__build_4968"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R82.10 \u003cTake 26",
                "product": {
                  "name": "Check Point Spark Firewall R82.10 \u003cTake 26",
                  "product_id": "T059969"
                }
              },
              {
                "category": "product_version",
                "name": "R82.10 Take 26",
                "product": {
                  "name": "Check Point Spark Firewall R82.10 Take 26",
                  "product_id": "T059969-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:spark_firewall:r82.10__take_26"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R82 \u003cTake 26",
                "product": {
                  "name": "Check Point Spark Firewall R82 \u003cTake 26",
                  "product_id": "T059970"
                }
              },
              {
                "category": "product_version",
                "name": "R82 Take 26",
                "product": {
                  "name": "Check Point Spark Firewall R82 Take 26",
                  "product_id": "T059970-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:spark_firewall:r82__take_26"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "R81.20 \u003cTake 26",
                "product": {
                  "name": "Check Point Spark Firewall R81.20 \u003cTake 26",
                  "product_id": "T059971"
                }
              },
              {
                "category": "product_version",
                "name": "R81.20 Take 26",
                "product": {
                  "name": "Check Point Spark Firewall R81.20 Take 26",
                  "product_id": "T059971-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:checkpoint:spark_firewall:r81.20__take_26"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Spark Firewall"
          }
        ],
        "category": "vendor",
        "name": "Check Point"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-85102",
      "product_status": {
        "known_affected": [
          "T059438",
          "T059305",
          "T059437",
          "T059439",
          "T059969",
          "T059441",
          "T059440",
          "T059300",
          "T059443",
          "T059971",
          "T059442",
          "T059970",
          "T059302",
          "T059434",
          "T059973",
          "T059301",
          "T059444",
          "T059972",
          "T059304",
          "T059436",
          "T059303",
          "T059435",
          "T059974"
        ]
      },
      "release_date": "2026-09-09T22:00:00.000+00:00",
      "title": "CVE-2026-85102"
    },
    {
      "cve": "CVE-2026-85103",
      "product_status": {
        "known_affected": [
          "T059306",
          "T059305",
          "T059308",
          "T059307",
          "T059969",
          "T059441",
          "T059440",
          "T059300",
          "T059443",
          "T059442",
          "T059302",
          "T059301",
          "T059444",
          "T059304",
          "T059303",
          "T059438",
          "T059437",
          "T059439",
          "T059971",
          "T059970",
          "T059973",
          "T059434",
          "T059972",
          "T059436",
          "T059974",
          "T059435"
        ]
      },
      "release_date": "2026-09-09T22:00:00.000+00:00",
      "title": "CVE-2026-85103"
    }
  ]
}

CVE-2026-85102 (GCVE-0-2026-85102)

Vulnerability from cvelistv5 – Published: 2026-09-09 13:00 – Updated: 2026-09-23 03:55

Title

Improper Certificate Validation in Quantum Security Gateway

Summary

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: active Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 00:00 UTC

CWE

CWE-295 - Improper Certificate Validation.

Assigner

checkpoint mitre root Scorecard

References

3 references

URL	Tags
https://support.checkpoint.com/results/sk/sk1000117
https://blog.checkpoint.com/security/security-adv…	vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

1 product

Vendor	Product	Version
checkpoint	Quantum Security Gateway	Affected: R82.10 with Jumbo Hotfix Take 43 or below Affected: R82 with Jumbo Hotfix Take 125 or below Affected: R81.20 with Jumbo Hotfix Take 165 or below

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85102",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-09-22",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T03:55:34.599Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory"
            ],
            "url": "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-85102"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-09-22T00:00:00.000Z",
            "value": "CVE-2026-85102 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Quantum Security Gateway",
          "vendor": "checkpoint",
          "versions": [
            {
              "status": "affected",
              "version": "R82.10 with Jumbo Hotfix Take 43 or below"
            },
            {
              "status": "affected",
              "version": "R82 with Jumbo Hotfix Take 125 or below"
            },
            {
              "status": "affected",
              "version": "R81.20 with Jumbo Hotfix Take 165 or below"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation.",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:00:31.206Z",
        "orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
        "shortName": "checkpoint"
      },
      "references": [
        {
          "url": "https://support.checkpoint.com/results/sk/sk1000117"
        }
      ],
      "title": "Improper Certificate Validation in Quantum Security Gateway",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
    "assignerShortName": "checkpoint",
    "cveId": "CVE-2026-85102",
    "datePublished": "2026-09-09T13:00:31.206Z",
    "dateReserved": "2026-09-03T06:38:15.701Z",
    "dateUpdated": "2026-09-23T03:55:34.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-85103 (GCVE-0-2026-85103)

Vulnerability from cvelistv5 – Published: 2026-09-09 13:00 – Updated: 2026-09-10 03:56

Title

Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding

Summary

A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-09 00:00 UTC

CWE

CWE-122 - Heap-based Buffer Overflow.

Assigner

checkpoint mitre root Scorecard

References

1 reference

URL	Tags
https://support.checkpoint.com/results/sk/sk1000118

Impacted products

2 products

Vendor	Product	Version
checkpoint	Quantum Security Gateway	Affected: R82.10 with Jumbo Hotfix Take 43 or below Affected: R82 with Jumbo Hotfix Take 125 or below Affected: R81.20 with Jumbo Hotfix Take 165 or below
checkpoint	Quantum Security Management	Affected: R82.10 with Jumbo Hotfix Take 43 or below Affected: R82 with Jumbo Hotfix Take 125 or below Affected: R81.20 with Jumbo Hotfix Take 165 or below

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85103",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T03:56:41.934Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Quantum Security Gateway",
          "vendor": "checkpoint",
          "versions": [
            {
              "status": "affected",
              "version": "R82.10 with Jumbo Hotfix Take 43 or below"
            },
            {
              "status": "affected",
              "version": "R82 with Jumbo Hotfix Take 125 or below"
            },
            {
              "status": "affected",
              "version": "R81.20 with Jumbo Hotfix Take 165 or below"
            }
          ]
        },
        {
          "product": "Quantum Security Management",
          "vendor": "checkpoint",
          "versions": [
            {
              "status": "affected",
              "version": "R82.10 with Jumbo Hotfix Take 43 or below"
            },
            {
              "status": "affected",
              "version": "R82 with Jumbo Hotfix Take 125 or below"
            },
            {
              "status": "affected",
              "version": "R81.20 with Jumbo Hotfix Take 165 or below"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow.",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:00:42.088Z",
        "orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
        "shortName": "checkpoint"
      },
      "references": [
        {
          "url": "https://support.checkpoint.com/results/sk/sk1000118"
        }
      ],
      "title": "Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
    "assignerShortName": "checkpoint",
    "cveId": "CVE-2026-85103",
    "datePublished": "2026-09-09T13:00:42.088Z",
    "dateReserved": "2026-09-03T06:38:15.701Z",
    "dateUpdated": "2026-09-10T03:56:41.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

WID-SEC-W-2026-3305

CVE-2026-85102 (GCVE-0-2026-85102)

CVE-2026-85103 (GCVE-0-2026-85103)

Tags

Sightings

Nomenclature

Related by attack behaviour