CVE-2026-85102: Check Point Quantum Gateway VPN Certificate Trust Validation Remote Code Execution

HERMES

HERMES THREAT SCORE & PERIMETER GATEWAY ATTACK SURFACE

Target: Check Point Quantum Security Gateway (vpnd / iked)

Confidence: 99%

96 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 19 / 20

Weaponization 18 / 20

Exposure 20 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 18 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-85102 at 9.8 (CRITICAL, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The Hermes Threat Score assigns an operational score of 96 (CRITICAL) due to exposed edge perimeter posture and imminent threat warnings issued by national CSIRTs.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-85102: Check Point VPN Certificate Trust Validation Remote Code ExecutionVULNERABILITY

Connected Nodes: 2

Active Relationships (Outgoing)

→ affectsPRODUCTCheck Point Quantum Security Gateway (Gaia OS)

99% VERY_HIGH

Unified security operating system powering Check Point Quantum Security Gateways, Spark appliances, and cloud firewalls.

🔍 Why is this related? (Evidence & Provenance)

“Directly disclosed in Check Point advisory sk1000117 affecting Quantum Security Gateways.”

Supporting Verified Evidence:

• [government_confirmation]Dutch NCSC and European cybersecurity authorities issued critical alert confirming imminent exploitation of Check Point VPN certificate trust validation and ASN.1 decoding buffer overflow. — Source: Dutch NCSC / Check Point / CERT-FR: Dutch NCSC & Check Point Security Advisory: Imminent Exploitation of Check Point VPN Flaws (CVE-2026-85102, CVE-2026-85103) (Reliability: VERY_HIGH)

→ affectsPRODUCTCheck Point Security Management

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Check Point Security Management documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Security Advisory: CWE-295 Improper Certificate Validation

CVSS v3.1: 9.8 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) / CWE-295: Improper Certificate Validation. Disclosed in Check Point Security Advisory sk1000117. Remediated via LivePatch Take 24 and official Jumbo Hotfix Accumulator updates.

Threat Intelligence Warning: Exploitation Imminent

On September 12, 2026, the Dutch Nationaal Cyber Security Centrum (NCSC-NL), CERT-EU, and European cybersecurity agencies issued an emergency warning indicating that active in-the-wild weaponization and exploitation of CVE-2026-85102 is imminent. Reconnaissance probes and anomalous IKE Phase 1 handshakes targeting UDP ports 500 and 4500 have surged worldwide.

Executive Summary

CVE-2026-85102 is a critical vulnerability affecting Check Point Quantum Security Gateways, Security Management Servers, and Spark appliances running Gaia OS. During Internet Key Exchange (IKEv1 / IKEv2) VPN negotiation, an unauthenticated remote attacker can submit a crafted public key certificate that bypasses trust-path verification and cryptographic signature constraints within vpnd. This logic failure leads to arbitrary memory corruption and native code execution with root privileges, allowing total takeover of the enterprise perimeter firewall.

---

1. Technical Context & Affected Software Matrix

The Check Point VPN daemon (vpnd) manages IPsec Site-to-Site and Remote Access VPN tunnels, processing IKE Security Association (SA) negotiations across enterprise perimeter environments.

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	CVE-2026-85102	Check Point Security Advisory sk1000117
Affected Product	checkpoint:gaia	Enterprise Firewall & Perimeter Security Gateway
Vulnerable Component	VPN Daemon (vpnd / iked)	IKEv1 / IKEv2 Certificate Validation Engine
Weakness Class	CWE-295: Improper Certificate Validation	Broken Cryptographic Authentication / Trust Boundary
CVSS v3.1 Score	9.8 (CRITICAL / Hermes Score 96)	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fixed Versions	R82.20, R82.10 Take 44, R82 Take 126, R81.20 Take 166, LivePatch Take 24	Emergency security release & dynamic hotfix
MITRE ATT&CK	T1190 - Exploit Public-Facing Application, T1068 - Exploitation for Privilege Escalation	Initial Access / Execution / Defense Evasion
Forensic Cross-Reference	Linux Process Memory and Heap Corruption Forensics	Memory analysis, core dumps, and network telemetry

Affected Release Branches

• Check Point Gaia R82.10: Vulnerable (Fixed in Jumbo Hotfix Accumulator Take 44 or LivePatch Take 24)
• Check Point Gaia R82: Vulnerable (Fixed in Jumbo Hotfix Accumulator Take 126 or LivePatch Take 24)
• Check Point Gaia R81.20: Vulnerable (Fixed in Jumbo Hotfix Accumulator Take 166 or LivePatch Take 24)
• Check Point Gaia R81.10, R81, R80.40 (End of Support): Vulnerable (No official patches; upgrade to supported releases required)
• Check Point Quantum Spark Appliances: Vulnerable (Fixed in R82.00.10 Build 2325+)
• Check Point Gaia R82.20: Not affected by design.

---

2. In-Depth Technical Decomposition & Root Cause

During IKE negotiation over UDP port 500 or UDP port 4500 (NAT-Traversal), the VPN gateway authenticates the remote peer using pre-shared keys (PSK) or X.509 digital certificates. In certificate-based authentication, the peer transmits an ISAKMP_PAYLOAD_CERT containing its public certificate and certificate chain.

The root cause of CVE-2026-85102 lies in the trust chain evaluation routine in vpnd:

// Decompiled representation of vulnerable certificate validation in vpnd (pre-patch)
int ike_verify_peer_certificate(ike_session_t *session, cert_payload_t *cert_data) {
    x509_ctx_t *peer_cert = NULL;
    int validation_status = 0;

    // Decode incoming certificate payload
    peer_cert = parse_x509_der(cert_data->data, cert_data->len);
    if (!peer_cert) {
        return IKE_ERR_MALFORMED_CERT;
    }

    /* VULNERABILITY (sk1000117 / CWE-295):
     * When evaluating custom certificate extensions or specific Subject Alternative
     * Names (SAN), the function sets session->peer_authenticated = 1 BEFORE
     * verifying the cryptographic signature against the local CA trust bundle.
     * Furthermore, an unvalidated pointer offset causes subsequent attribute
     * extraction to dereference attacker-controlled offsets within vpnd heap. */
    if (peer_cert->has_extended_key_usage) {
        session->peer_identity = extract_san_attribute(peer_cert);
        session->peer_authenticated = 1; // Logic shortcut: Trust granted prematurely!
    } else {
        validation_status = x509_verify_signature_chain(peer_cert, session->ca_store);
    }

    // Processing continues assuming trusted state
    return process_ike_sa_establishment(session);
}

When an attacker initiates an IKE Phase 1 exchange with a specially crafted certificate containing manipulated extension fields:

1. The trust evaluation logic skips the signature verification step (x509_verify_signature_chain).
2. The state machine transitions the session into an authenticated state.
3. An unchecked offset inside the extension parser dereferences uninitialized or out-of-bounds pointer data, triggering memory corruption that can be leveraged to hijack execution flow into an attacker-controlled ROP chain or shellcode payload.

---

3. Attack Scenarios & Threat Modeling

1. Reconnaissance & Service Identification: The threat actor identifies internet-facing Check Point Quantum gateways exposing UDP port 500 (IKE) and UDP port 4500 (IPsec NAT-T).
2. Crafted IKE Handshake: The attacker sends an IKE Phase 1 Proposal containing aggressive or main mode payloads, accompanied by a forged X.509 certificate payload with anomalous extended key attributes.
3. Trust Bypass & State Corruption: vpnd ingests the certificate, fails to validate the cryptographic chain of trust against the internal Certificate Authority ($CPDIR/conf/sic_cert.p12), and commits the connection state.
4. Execution Hijacking: The memory corruption primitive overwrites critical dispatch pointers in the vpnd process space on Gaia OS.
5. Perimeter Takeover & Lateral Movement: The attacker gains an interactive root shell on the firewall appliance, retrieves pre-shared keys, dumps internal routing tables, and establishes encrypted tunnels to pivot into the internal network.

---

4. Forensic Detection, Artifacts & System Logs

Security operations teams and forensic investigators can detect exploitation attempts by monitoring gateway process crashes, reviewing IKE negotiation logs, and inspecting network traffic.

Gateway Daemon Monitoring

Inspect /var/log/messages and $FWDIR/log/vpnd.elg for segmentation faults: vpnd[pid]: segfault at ... ip ... sp ... error 4 in vpnd or rapid restarts of vpnd tracked by cpwd_admin list.

LivePatch Verification

Run cplp list in Gaia CLI (expert mode) to confirm whether LivePatch Take 24 is loaded in memory: cplp list | grep -i "take 24".

Network & Host Threat Hunting Rules

Suricata / Snort Rule

emerging_checkpoint_cve_2026_85102.rules

alert udp any any -> $EXTERNAL_NET [500,4500] (
    msg:"HERMES INTEL - Check Point VPN IKE Anomalous Certificate Handshake (CVE-2026-85102)";
    flow:to_server;
    content:"|00 00 00|"; depth:3; # ISAKMP header probe
    content:"|06|"; distance:16; within:1; # ISAKMP Certificate Payload Type 6
    byte_test:2,>,4096,0,relative; # Anomalous oversized certificate payload
    threshold:type limit, track by_src, count 1, seconds 300;
    classtype:attempted-admin;
    sid:202685102; rev:1;
)

Sigma Rule

sigma_checkpoint_vpnd_anomaly.yaml

title: Check Point vpnd Abnormal Child Process Spawned
id: cve-2026-85102-vpnd-spawn
status: critical
description: Detects unusual child processes spawned by Check Point VPN daemon (vpnd), indicative of RCE exploitation.
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|endswith: '/vpnd'
        Image|endswith:
            - '/bin/sh'
            - '/bin/bash'
            - '/usr/bin/curl'
            - '/usr/bin/wget'
            - '/usr/bin/python'
            - '/bin/nc'
    condition: selection
fields:
    - CommandLine
    - ParentProcessName
    - User
level: critical

eBPF Tracepoint

# Monitor child process executions from vpnd in real time
sudo bpftrace -e '
tracepoint:syscalls:sys_enter_execve /comm == "vpnd"/ {
    printf("[ALERT] vpnd (PID %d) executed: %s
", pid, str(args->filename));
}'

---

5. Remediation & Hardening Guidelines

To neutralize the risk of immediate exploitation, organizations running Check Point gateways must execute the following remediation procedures:

1. Deploy Check Point LivePatch (Zero Downtime): If LivePatch is enabled, verify installation of LivePatch Take 24 via cplp list. LivePatch injects in-memory hot-fixes without restarting services or dropping active VPN tunnels.
2. Apply Jumbo Hotfix Accumulator: If LivePatch is unavailable, install the relevant Jumbo Hotfix release:
   • R82.10: Jumbo Hotfix Accumulator Take 44 or higher.
   • R82: Jumbo Hotfix Accumulator Take 126 or higher.
   • R81.20: Jumbo Hotfix Accumulator Take 166 or higher.
   • Quantum Spark: Build R82.00.10 (Build 2325) or higher.
3. Temporary Mitigation (Site-to-Site VPN):
   • In SmartConsole, navigate to Global Properties > VPN > Advanced.
   • Disable Accept VPN IKE packets on UDP 500/4500 as an implied rule.
   • Manually create explicit firewall rules permitting UDP 500 and UDP 4500 solely from known, authorized peer IP addresses. (Note: This workaround cannot protect Remote Access VPN with roaming users).
4. Forensic Guidance: For deep incident response methodology on compromised perimeter appliances, consult Linux Process Memory and Heap Corruption Forensics.