Search/CVE-2026-85103
● CVE — Critical

CVE-2026-85103

DiscoveredSep 9, 2026UpdatedSep 10, 2026

A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.

View graph Watch Export
CVSS v3.1
9.8 CRITICAL
EPSS
4.29%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
8
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Sep 11, 2026 → Oct 26, 2026
▲ 3.93pp
0.36% → 4.29% over 4 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
14 relationships
Timeline
disclosure → media coverage
Sep 9, 2026
Disclosure — published as a CVE record.
Sep 11, 2026
securityweek.com reports: Check Point Patches Critical VPN Vulnerabilities
Sep 12, 2026
bleepingcomputer.com reports: Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent
Sep 17, 2026
thehackernews.com reports: Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
Sep 18, 2026
bleepingcomputer.com reports: New Check Point flaw lets hackers execute code with root privileges
Sep 22, 2026
bleepingcomputer.com reports: Check Point warns of Management Server zero-day exploited in attacks
Sep 22, 2026
thehackernews.com reports: Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
Sep 23, 2026
advisories.ncsc.nl reports: NCSC-2026-0365 [1.01] [H/H] Kwetsbaarheden verholpen in Check Point VPN-producten
Sep 23, 2026
bleepingcomputer.com reports: InfraTrust report warns network management systems under attack