Critical RCE Vulnerabilities in Check Point Quantum Security Gateway

• •Two critical RCE vulnerabilities (CVE-2026-85102, CVE-2026-85103) in Check Point Quantum Security.
• •Public proof-of-concept code is available, increasing the risk of exploitation.
• •Immediate patching is required for affected systems to prevent potential breaches.

Two critical vulnerabilities (CVE-2026-85102 and CVE-2026-85103) have been identified in Check Point Quantum Security Gateway, allowing unauthenticated remote code execution (RCE). Both vulnerabilities stem from improper handling of VPN certificate ASN.1 decoding and trust validation. The Dutch NCSC issued an alert on September 12, 2026, warning of expected exploitation attempts, although no attacks have been confirmed yet. Affected systems include various versions of Quantum Security Gateway and Management with specific Jumbo Hotfix Accumulator Takes. Administrators are advised to apply the necessary hotfixes immediately to mitigate the risk of exploitation. The vulnerabilities are critical, with a CVSS score of 9.8, indicating a high potential impact if exploited. Monitoring logs for unusual activity is also recommended until patches are applied.