THE BASE COLLECTIONCRDS / 0.1

CVE-2026-85102CRITICAL

Check Point Quantum Gateway

KNOWN EXPLOITED

initial accessT1190

Check Point gateways accept an untrusted certificate during virtual private network (VPN) negotiation, which lets an unauthenticated remote attacker run code on the gateway itself.

CVSS

9.8

EPSS

PATCH

—

Patch Quantum Security Gateway and Spark per Check Point sk1000117 now; take internet-facing gateways first and check them for signs of compromise.

SCRTY:CRDS / BASE SETREV. 01 ◆

Raw JSON

One vulnerability. The facts that matter.
A clear next move.

critical Known exploitedREV. 01

CVE-2026-85102Check Point Quantum Gateway — VPN certificate trust flaw to RCE

Check Point gateways accept an untrusted certificate during virtual private network (VPN) negotiation, which lets an unauthenticated remote attacker run code on the gateway itself.

YOUR NEXT MOVE

Patch Quantum Security Gateway and Spark per Check Point sk1000117 now; take internet-facing gateways first and check them for signs of compromise.

Read the risk

THE VITAL STATS

CVSS score: 9.8/ 10
EPSS probability: 0%
Attack complexity: Low
Known exploited: Yes — CISA KEV
CVE published: 2026-09-09
Added to KEV: 2026-09-22
Exploit published: Not recorded
Confidence: medium
Kill chain: initial access
MITRE ATT&CK: T1190
Severity: critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attacker needsNetwork reach to a gateway with site-to-site or remote-access VPN enabled; no credentials needed.

Behind the card

2 REFERENCES

Field-level provenanceTRACE THE SOURCES +

Which source supports each field, when it was retrieved, and who extracted it.

Fields	Source	Retrieved	Extractor	Confidence
cvss, exploitation.attack_complexity, exploitation.exploit_available, references, published_at	nvd.nist.gov	2026-09-23	scrty-crds-pipeline/0.1	high
exploitation.known_exploited, exploitation.kev_added	cisa.gov	2026-09-23	scrty-crds-pipeline/0.1	high
epss	api.first.org	2026-09-23	scrty-crds-pipeline/0.1	high
title, summary, severity, remediation, mitre_attack, kill_chain, recommended_action, confidence, tags, exploitation.prerequisites	nvd.nist.gov	2026-09-23	claude-code	high

Printing history

THE RECORD

r12026-09-23Initial base card

First printing. This card has not been reprinted since publication.