cvelistv5 - cve-2026-85103

CVE-2026-85103 (GCVE-0-2026-85103)

Vulnerability from cvelistv5

Published

2026-09-09 13:00

Modified

2026-09-10 03:56

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-122 - Heap-based Buffer Overflow.

Summary

A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.

References

URL

Tags

https://support.checkpoint.com/results/sk/sk1000118

Impacted products

Vendor

Product

Version

checkpoint

Quantum Security Gateway

Version: R82.10 with Jumbo Hotfix Take 43 or below
Version: R82 with Jumbo Hotfix Take 125 or below
Version: R81.20 with Jumbo Hotfix Take 165 or below

checkpoint

Quantum Security Management

Version: R82.10 with Jumbo Hotfix Take 43 or below
Version: R82 with Jumbo Hotfix Take 125 or below
Version: R81.20 with Jumbo Hotfix Take 165 or below

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-85103",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-09T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T03:56:41.934Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Quantum Security Gateway",
          "vendor": "checkpoint",
          "versions": [
            {
              "status": "affected",
              "version": "R82.10 with Jumbo Hotfix Take 43 or below"
            },
            {
              "status": "affected",
              "version": "R82 with Jumbo Hotfix Take 125 or below"
            },
            {
              "status": "affected",
              "version": "R81.20 with Jumbo Hotfix Take 165 or below"
            }
          ]
        },
        {
          "product": "Quantum Security Management",
          "vendor": "checkpoint",
          "versions": [
            {
              "status": "affected",
              "version": "R82.10 with Jumbo Hotfix Take 43 or below"
            },
            {
              "status": "affected",
              "version": "R82 with Jumbo Hotfix Take 125 or below"
            },
            {
              "status": "affected",
              "version": "R81.20 with Jumbo Hotfix Take 165 or below"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "CWE-122: Heap-based Buffer Overflow.",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:00:42.088Z",
        "orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
        "shortName": "checkpoint"
      },
      "references": [
        {
          "url": "https://support.checkpoint.com/results/sk/sk1000118"
        }
      ],
      "title": "Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
    "assignerShortName": "checkpoint",
    "cveId": "CVE-2026-85103",
    "datePublished": "2026-09-09T13:00:42.088Z",
    "dateReserved": "2026-09-03T06:38:15.701Z",
    "dateUpdated": "2026-09-10T03:56:41.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-85103\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-09T15:14:17.016329Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-09T15:14:26.489Z\"}}], \"cna\": {\"title\": \"Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"checkpoint\", \"product\": \"Quantum Security Gateway\", \"versions\": [{\"status\": \"affected\", \"version\": \"R82.10 with Jumbo Hotfix Take 43 or below\"}, {\"status\": \"affected\", \"version\": \"R82 with Jumbo Hotfix Take 125 or below\"}, {\"status\": \"affected\", \"version\": \"R81.20 with Jumbo Hotfix Take 165 or below\"}]}, {\"vendor\": \"checkpoint\", \"product\": \"Quantum Security Management\", \"versions\": [{\"status\": \"affected\", \"version\": \"R82.10 with Jumbo Hotfix Take 43 or below\"}, {\"status\": \"affected\", \"version\": \"R82 with Jumbo Hotfix Take 125 or below\"}, {\"status\": \"affected\", \"version\": \"R81.20 with Jumbo Hotfix Take 165 or below\"}]}], \"references\": [{\"url\": \"https://support.checkpoint.com/results/sk/sk1000118\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-122\", \"description\": \"CWE-122: Heap-based Buffer Overflow.\"}]}], \"providerMetadata\": {\"orgId\": \"897c38be-0345-43cd-b6cf-fe179e0c4f45\", \"shortName\": \"checkpoint\", \"dateUpdated\": \"2026-09-09T13:00:42.088Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-85103\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-10T03:56:41.934Z\", \"dateReserved\": \"2026-09-03T06:38:15.701Z\", \"assignerOrgId\": \"897c38be-0345-43cd-b6cf-fe179e0c4f45\", \"datePublished\": \"2026-09-09T13:00:42.088Z\", \"assignerShortName\": \"checkpoint\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

CERTFR-2026-AVI-1152

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans les produits Check Point. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

L'éditeur précise que les versions R80, R80.10, R80.20, R80.30, R80.40, R81 et R81.10 de Security Gateways, Security Management Server et des pare-feux Spark sont en fin de service et ne recevront donc pas de correctif.

Impacted products

Vendor	Product	Description
Check Point	Security Management	Security Management versions R82 antérieures à R82 take 24
Check Point	Security Management	Security Management versions R82.10 antérieures à R82.10 take 24
Check Point	Spark Firewalls	Spark Firewalls versions R82.10 antérieures à R82.10 take 24
Check Point	Security Gateway	Security Gateway versions R81.20 antérieures à R81.20 take 24
Check Point	Security Gateway	Security Gateway versions R82.10 antérieures à R82.10 take 24
Check Point	Spark Firewalls	Spark Firewalls versions R81.20 antérieures à R81.20 take 24
Check Point	Spark Firewalls	Spark Firewalls versions R82 antérieures à R82 take 24
Check Point	Security Gateway	Security Gateway versions R82 antérieures à R82 take 24
Check Point	Security Management	Security Management versions R81.20 antérieures à R81.20 take 24

References

Title

Publication Time

Tags

Bulletin de sécurité Check Point sk1000118	2026-09-08	vendor-advisory
Bulletin de sécurité Check Point sk1000117	2026-09-08	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Security Management versions R82 ant\u00e9rieures \u00e0 R82 take 24",
      "product": {
        "name": "Security Management",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "Security Management versions R82.10 ant\u00e9rieures \u00e0 R82.10 take 24",
      "product": {
        "name": "Security Management",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "Spark Firewalls versions R82.10 ant\u00e9rieures \u00e0 R82.10 take 24",
      "product": {
        "name": "Spark Firewalls",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "Security Gateway versions R81.20 ant\u00e9rieures \u00e0 R81.20 take 24",
      "product": {
        "name": "Security Gateway",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "Security Gateway versions R82.10 ant\u00e9rieures \u00e0 R82.10 take 24",
      "product": {
        "name": "Security Gateway",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "Spark Firewalls versions R81.20 ant\u00e9rieures \u00e0 R81.20 take 24",
      "product": {
        "name": "Spark Firewalls",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "Spark Firewalls versions R82 ant\u00e9rieures \u00e0 R82 take 24",
      "product": {
        "name": "Spark Firewalls",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "Security Gateway versions R82 ant\u00e9rieures \u00e0 R82 take 24",
      "product": {
        "name": "Security Gateway",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    },
    {
      "description": "Security Management versions R81.20 ant\u00e9rieures \u00e0 R81.20 take 24",
      "product": {
        "name": "Security Management",
        "vendor": {
          "name": "Check Point",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "L\u0027\u00e9diteur pr\u00e9cise que les versions R80, R80.10, R80.20, R80.30, R80.40, R81 et R81.10 de Security Gateways, Security Management Server et des pare-feux Spark sont en fin de service et ne recevront donc pas de correctif.",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-85102",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85102"
    },
    {
      "name": "CVE-2026-85103",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-85103"
    }
  ],
  "initial_release_date": "2026-09-10T00:00:00",
  "last_revision_date": "2026-09-10T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1152",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-09-10T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Check Point. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Check Point",
  "vendor_advisories": [
    {
      "published_at": "2026-09-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Check Point sk1000118",
      "url": "https://support.checkpoint.com/results/sk/sk1000118"
    },
    {
      "published_at": "2026-09-08",
      "title": "Bulletin de s\u00e9curit\u00e9 Check Point sk1000117",
      "url": "https://support.checkpoint.com/results/sk/sk1000117"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2026-85103 (GCVE-0-2026-85103)

Vulnerability from cvelistv5

CERTFR-2026-AVI-1152

Vulnerability from certfr_avis

Solutions

Tags

Sightings

Nomenclature