EUVD-2026-75010
GHSA-g4cm-76f6-qvmc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach gateway VPN/IKE service
-
DeliverySend crafted VPN certificate
-
ExploitOverflow heap in ASN.1 decoder
-
ExecutionHijack control flow
-
PersistExecute code on appliance
-
ImpactPivot into protected network
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target expose the VPN certificate-handling path - i.e., a Quantum Security Gateway running IKE/VPN services that accept and decode certificates, or a reachable Quantum Security Management instance - to the attacker's network position. Per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or non-default special configuration is stated as required, so any internet-facing gateway terminating VPN with certificate authentication is in scope. Limiting factors: the attacker must be able to drive a certificate/ASN.1 exchange with the service, so gateways with VPN disabled or with VPN reachability tightly firewalled to known peers present a substantially smaller attack surface; precise affected versions are unconfirmed in the input and should be verified against sk1000118. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) describes the worst-case signal set: remote, low-complexity, no authentication, no user interaction, full confidentiality/integrity/availability impact - consistent with a pre-auth overflow in an internet-facing VPN parser. No EPSS score, KEV listing, or POC was supplied, so active exploitation cannot be claimed and there is no public exploit identified at time of analysis; this tempers the immediate-threat picture without lowering the structural severity. SSVC-style reading: exploitation currently 'none' observed, technical impact 'total,' and automatability is plausible given a network-reachable unauthenticated path, though real-world reliability of heap RCE across appliance builds is unproven. Net: a genuine high priority because the asset class (perimeter gateways) is high-value and the vector is unauthenticated, even though exploitation maturity is currently unconfirmed. Affected version ranges are not enumerated in the input - verify against the vendor SK before scoping. |
| Exploit ScenarioDerived | An attacker who can reach the gateway's VPN/IKE service sends a crafted VPN certificate containing a malformed ASN.1 structure during negotiation. The oversized/malformed field overflows a heap buffer in the certificate decoder, corrupting adjacent heap memory and allowing the attacker to execute code on the appliance without any credentials or user interaction. No public proof-of-concept is identified at time of analysis, but the low-complexity unauthenticated vector makes weaponization attractive. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based buffer overflow in the ASN.1 decoder that parses VPN certificates, reachable by unauthenticated remote attackers. Because the flaw sits in the certificate-handling path of the internet-facing VPN service, a single crafted certificate or handshake can overflow heap memory and execute attacker-controlled code on security appliances that sit at the network perimeter. No public exploit identified at time of analysis, and the CVE carries no EPSS or KEV signal, but the pre-auth network-reachable RCE profile makes it a top-tier patching priority.
RemediationAI
Apply the fix referenced in Check Point advisory sk1000118 (https://support.checkpoint.com/results/sk/sk1000118) - typically delivered as a jumbo hotfix take or version upgrade for the affected Gaia/Quantum releases; the input does not contain an exact fixed version, so treat the SK as the authoritative patch source (Patch available per vendor advisory; exact version not provided in input). Until patched, reduce exposure by restricting which peers can initiate VPN/IKE certificate exchange: limit remote-access and site-to-site VPN reachability to known peer IPs via the gateway policy, and front the management interface so Quantum Security Management is never directly reachable from untrusted networks. These controls reduce the unauthenticated attack surface but do not eliminate risk for gateways that must accept VPN connections from arbitrary clients, and tightening peer restrictions may break legitimate remote-access users - coordinate with VPN operations before enforcing.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-122 heap-based buffer overflow in the routine that performs ASN.1 decoding of X.509/VPN certificates within Check Point's Gaia-based Quantum products. ASN.1 is the binary encoding used for certificates exchanged during IKE/TLS VPN negotiation; decoders are historically error-prone because they parse attacker-supplied length and tag fields, and a malformed or oversized structure can drive a copy past an allocated heap buffer. Control over the overflowing bytes on the heap can corrupt adjacent allocations or metadata, enabling control-flow hijack. The affected components per the description are Quantum Security Management (the management plane) and Quantum Security Gateway (the enforcement/firewall-VPN plane); exact CPE strings and affected build/version ranges were not provided in the input and must be taken from Check Point SK sk1000118.
Know when Checkpoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated, network-reachable overflow in the VPN certificate parser with no user interaction, yielding code execution on the appliance, so full C/I/A impact.
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
DescriptionCVE.org
A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.
Technical POC Analysis
Bug class: CWE-122, heap-based buffer overflow.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Check Point Quantum Security Gateway and Management systems are vulnerable to unauthenticated remote code execution via malformed VPN certificates, allowing attackers to completely compromise security appliances protecting network perimeters. With no vendor patch currently available and the flaw residing in the pre-authentication certificate-handling path, organizations operating these systems face immediate risk of network perimeter breach and lateral movement into protected infrastructure.
Until vendor patch is released: implement network segmentation to isolate Quantum appliances behind additional inspection points, deploy certificate-validation rules at network boundaries to block malformed ASN.1 structures, restrict VPN client connections to whitelisted source IP ranges where operationally feasible, increase security monitoring on VPN connection attempts for anomalous patterns, maintain isolated backup network segments for critical services, and establish daily monitoring of Check Point security advisories for patch availability notifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Elevated-privilege container restoration in CRI-O 1.34 and later, including downstream Red Hat OpenShift Container Platf
Exploit-DB