{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Check Point heeft 2 kritieke kwetsbaarheden verholpen.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheid met kenmerk CVE-2026-85102 heeft een CVSS-score van 9,8. De kwetsbaarheid bevindt zich in het VPN-onderhandelingsproces van de Quantum Security Gateway en wordt veroorzaakt door onjuiste validatie van certificaatvertrouwen. Hierdoor kan een niet-geauthenticeerde externe aanvaller authenticatiecontroles omzeilen en willekeurige code uitvoeren op de Security Gateway. Exploitatie vindt plaats tijdens de VPN-onderhandeling, waarbij certificaatgegevens onvoldoende worden gevalideerd.  De kwetsbaarheid geldt voor Security Gateway en Check Point Spark Firewall wanneer Site-to-Site VPN of Remote Access VPN wordt gebruikt.  \nVoor Site-to-Site VPN adviseert Check Point om implied rules for VPN uit te schakelen en VPN-toegang voor UDP/500 en UDP/4500 alleen expliciet toe te staan voor de specifieke peer-IP-adressen. Deze mitigatie is niet van toepassing op lokaal beheerde Spark Firewalls.\n\nDe kwetsbaarheid met kenmerk CVE-2026-85103 heeft een CVSS-score van 9,8. Het betreft een heap-based buffer overflow in de ASN.1-decoding van VPN-certificaten, veroorzaakt door onjuiste verwerking van ASN.1-datastructuren tijdens de certificaatverwerking. Een niet-geauthenticeerde externe aanvaller kan deze kwetsbaarheid misbruiken om willekeurige code uit te voeren op het getroffen systeem. De kwetsbaarheid bevindt zich in een component die onderdeel is van de VPN-infrastructuur en kan bij succesvolle exploitatie de vertrouwelijkheid, integriteit en beschikbaarheid van het getroffen systeem be\u00efnvloeden.\n\nHet NCSC verwacht dat op korte termijn pogingen tot grootschalig misbruik zullen plaatsvinden en roept organisaties op de advisory van Check Point met spoed op te volgen.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Check Point heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Heap-based Buffer Overflow",
        "title": "CWE-122"
      },
      {
        "category": "general",
        "text": "Improper Certificate Validation",
        "title": "CWE-295"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://support.checkpoint.com/results/sk/sk1000117"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://support.checkpoint.com/results/sk/sk1000118"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Check Point VPN producten",
    "tracking": {
      "current_release_date": "2026-09-10T09:12:56.711517Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0365",
      "initial_release_date": "2026-09-10T09:12:56.711517Z",
      "revision_history": [
        {
          "date": "2026-09-10T09:12:56.711517Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Quantum Security Gateway"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Quantum Security Management"
          }
        ],
        "category": "vendor",
        "name": "checkpoint"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-85103",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Heap-based Buffer Overflow",
          "title": "CWE-122"
        },
        {
          "category": "description",
          "text": "A heap-based buffer overflow in ASN.1 decoding of VPN certificates allows unauthenticated remote code execution on Check Point Quantum Security Management and Quantum Security Gateway systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85103 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85103.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-85103"
    },
    {
      "cve": "CVE-2026-85102",
      "cwe": {
        "id": "CWE-295",
        "name": "Improper Certificate Validation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Certificate Validation",
          "title": "CWE-295"
        },
        {
          "category": "description",
          "text": "A vulnerability in Check Point Quantum Security Gateway\u0027s VPN negotiation process due to improper certificate trust validation allows unauthenticated remote attackers to execute arbitrary code on the Gateway.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-85102 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85102.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-85102"
    }
  ]
}