CVE-2026-85103

CriticalCVSS 9.8/10Last modified Sep 10, 2026

Description

A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
checkpoint	Quantum Security Gateway	R82.10 with Jumbo Hotfix Take 43 or below; R82 with Jumbo Hotfix Take 125 or below; R81.20 with Jumbo Hotfix Take 165 or below
checkpoint	Quantum Security Management	R82.10 with Jumbo Hotfix Take 43 or below; R82 with Jumbo Hotfix Take 125 or below; R81.20 with Jumbo Hotfix Take 165 or below

References

https://support.checkpoint.com/results/sk/sk1000118

Timeline

Published: Sep 9, 2026
Last modified: Sep 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-851045.3In Sooma 2GEN brain stimulator, an attacker within Bluetooth range can make unauthenticated changes to brain stimulation parameters.CVE-2026-851057.3A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the com CVE-2026-851066.3A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/ap CVE-2026-851074.3A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file app CVE-2026-851087.5Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsi CVE-2026-851099.8A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formLogin of the file /boaform/formLogin of the comp CVE-2026-85119.6Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafte CVE-2026-851108.8A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formWlanSetup of the file /boaform/formWlanSetup of the com CVE-2026-851118.7Allocation of Resources Without Limits or Throttling in Apache James Mime4J library prior version 0.8.15 allows Denial of Service upon parsi CVE-2026-851136.5The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pa CVE-2026-851147.5A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do n CVE-2026-851155.5A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do n