Metraipolis › archive › dc_7fc8fd950d73

KEV CVE-2026-85102: Check Point Multiple Products — Check Point Multiple Products Improper Certificate Validation Vulnerability

Source: CISA KEV
Original: https://nvd.nist.gov/vuln/detail/CVE-2026-85102
License (as archived): CC0-1.0
Archived: 2026-10-07T07:58:32.129Z
SHA-256 of the archived text: 33b959f7764256508d9e6ed36802da866c9fe05cd2ba19f8eca4c53c47f9f9ea
Stable URL of this page: https://metraipolis.com/documento/dc_7fc8fd950d73

How to cite

KEV CVE-2026-85102: Check Point Multiple Products — Check Point Multiple Products Improper Certificate Validation Vulnerability — CISA KEV, https://nvd.nist.gov/vuln/detail/CVE-2026-85102 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_7fc8fd950d73 (Metraipolis archive dc_7fc8fd950d73, sha256 33b959f7764256508d9e6ed36802da866c9fe05cd2ba19f8eca4c53c47f9f9ea)

BibTeX

@misc{dc7fc8fd950d73,
  title = {KEV CVE-2026-85102: Check Point Multiple Products — Check Point Multiple Products Improper Certificate Validation Vulnerability},
  howpublished = {CISA KEV},
  url = {https://nvd.nist.gov/vuln/detail/CVE-2026-85102},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_7fc8fd950d73; sha256 33b959f7764256508d9e6ed36802da866c9fe05cd2ba19f8eca4c53c47f9f9ea},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: CISA KEV, https://nvd.nist.gov/vuln/detail/CVE-2026-85102. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

CVE-2026-85102 è nel catalogo CISA delle vulnerabilità SFRUTTATE attivamente (Known Exploited Vulnerabilities), aggiunta il 2026-09-22.
Prodotto: Check Point Multiple Products — Check Point Multiple Products Improper Certificate Validation Vulnerability
Descrizione: Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.
Azione richiesta (agenzie federali USA): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Scadenza: 2026-09-25.
Uso noto in campagne ransomware: Unknown
Debolezze: CWE-295
Note e riferimenti: https://support.checkpoint.com/results/sk/sk1000117 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-85102

Fonte: catalogo CISA KEV (CC0 1.0), versione 2026.10.04, consultato il 2026-10-06: https://www.cisa.gov/known-exploited-vulnerabilities-catalog