Check Point Quantum EUVD-2026-75009

The attacker must be able to participate in a VPN negotiation with the Check Point Quantum Security Gateway and present a certificate during that handshake; the flaw lies in how the gateway validates certificate trust, so exploitation is bound to the VPN-negotiation code path (IKE/SSL-VPN) rather than arbitrary services. The provided CVSS marks it unauthenticated and network-reachable (PR:N, AV:N, UI:N), meaning no valid credentials or user interaction are required; the practical limiting factor is the need to interpose in or drive a VPN negotiation and supply a malicious/forged certificate, and exposure depends on the gateway having an internet-facing VPN listener enabled. Exact affected versions are not specified in the available data.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H = 9.8) paints a worst-case picture of trivial, unauthenticated, network-reachable full compromise of a security perimeter device - a scenario that warrants emergency patching because a compromised VPN gateway yields a foothold into the protected network. However, two signals temper the raw score: there is no EPSS value, no KEV listing, and no known public exploit, so exploitation is currently theoretical rather than observed; and the AC:L rating is questionable for a certificate-validation flaw, since exploiting CWE-295 typically requires interposing in or initiating the VPN negotiation and presenting a crafted certificate, which is better modeled as higher attack complexity. Even a mid-sized municipal IT team should treat an unauthenticated RCE on an internet-facing VPN gateway as urgent regardless, because these devices are high-value, directly exposed, and historically targeted en masse once a working exploit appears. Net assessment: genuinely high priority due to asset criticality and impact, but the 'AC:L, widely weaponizable' framing is not yet supported by exploitation evidence.

An attacker positioned to participate in or intercept a VPN negotiation with an exposed Quantum gateway presents a specially crafted or forged certificate during the handshake; the gateway's improper trust validation mishandles it and executes attacker-supplied code with gateway privileges, giving the attacker control of the perimeter device and a pivot into the internal network. No public exploit code is known at this time, so this remains a plausible but unproven scenario.