CVE-2026-85103

Awaiting Analysis Awaiting Analysis - Queue

Heap-based Buffer Overflow in Check Point Quantum Security

Publication date: 2026-09-09

Last updated on: 2026-09-10

Assigner: Check Point Software Technologies Ltd.

Description

A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-85103

EUVD

EUVD-2026-75010

Affected Vendors & Products

Vendor	Product	Version / Range
checkpoint	quantum_security_management	*
checkpoint	quantum_security_gateway	*
checkpoint	security_management_server	*
checkpoint	security_gateway	*
checkpoint	spark_firewall	*
checkpoint	security_management_server	to 82.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This is a heap-based buffer overflow vulnerability in VPN certificate ASN.1 decoding. It allows an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.

Detection Guidance

Check Point provides detection methods via their updates. Run `cpinfo -y CPupdates` to verify if the system has received the LivePatch or hotfix for CVE-2026-85103. Alternatively, use `cplp list` to check for the CVE identifier in installed protections.

Impact Analysis

An attacker could exploit this to gain control over affected systems, potentially leading to data breaches, unauthorized access, or disruption of security services. The high CVSS score of 9.8 indicates significant risk.

Compliance Impact

This vulnerability could lead to unauthorized code execution on critical security infrastructure, potentially compromising data confidentiality and integrity. For GDPR, it may result in unauthorized access to personal data, triggering breach notification requirements. Under HIPAA, it could expose protected health information if exploited on systems handling medical data.

Mitigation Strategies

Disable implied VPN rules and manually define VPN access for UDP ports 500 and 4500 for specific peer IP addresses. Note this does not apply to locally managed Spark Firewalls. Apply automatic LivePatch updates or install relevant hotfix accumulators to resolve the issue.

Hi! I’m here to help you understand CVE-2026-85103. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70