Detect CVE-2026-85102: Check Point Multiple Products Improper Certificate Validation Exploitation in CrowdStrike LogScale
Detects exploitation and post-exploitation activity associated with CVE-2026-85102, an improper certificate validation vulnerability (CWE-295) affecting multiple Check Point products. The flaw allows an attacker to present forged or mismatched TLS certificates that Check Point components accept without proper validation, enabling machine-in-the-middle interception of management/VPN/gateway sessions, credential capture, and unauthorized session establishment. This CVE is listed in the CISA KEV catalog and is subject to BOD 26-04 remediation timelines. Detection focuses on TLS anomalies (self-signed/untrusted CA chains, certificate CN/SAN mismatches, sudden fingerprint changes) toward Check Point management and gateway interfaces, anomalous administrator/VPN authentication following such TLS events, and configuration or firmware activity indicative of exploitation.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName=/NetworkConnect|ExternalApiCall/ OR #repo=checkpoint
| Vendor="Check Point"
| (RawEvent=/self_signed/i OR RawEvent=/untrusted_ca/i OR RawEvent=/cn_mismatch/i OR RawEvent=/cert_validation_failed/i OR RawEvent=/chain_incomplete/i)
| case { RawEvent=/administrator|VPN|Login/i | AuthFollowup:="true"; * | AuthFollowup:="false"; }
| groupBy([SourceIp, DestinationIp, DestinationPort], function=[count(as=cert_events), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen), collect([AuthFollowup])])
| cert_events > 0
| sort(cert_events, order=desc)CrowdStrike LogScale/CQL query over ingested Check Point telemetry identifying certificate validation anomalies and any co-located authentication activity indicative of CVE-2026-85102 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Third-party ingest normalization gaps causing benign events to match regex
- Certificate rotation windows on management appliances
- Authorized penetration tests presenting invalid certificates
Other platforms for CVE-2026-85102
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Present self-signed certificate to Check Point management interface
Expected signal: TLS handshake logs showing an untrusted/self-signed certificate presented for the management interface hostname; verify error in client output.
- Test 2CN/SAN mismatch certificate presentation
Expected signal: Handshake record where certificate CN (wrong-host.example) differs from requested SNI (cp-gw.internal).
- Test 3Invalid certificate acceptance followed by simulated admin login
Expected signal: Outbound TLS connection to management API with certificate validation disabled, followed by an administrator login attempt in Check Point audit logs.
References (4)
- https://support.checkpoint.com/results/sk/sk1000117
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-85102
Response Playbook
Triage
- Confirm the affected Check Point product and version against sk1000117 and determine whether the fixed hotfix/JHF has been applied to the source gateway, management server, or endpoint client.
- Review the certificate anomaly details (subject CN/SAN, issuer, fingerprint) from the alert and compare against the organization's known-good certificate inventory for that Check Point interface to confirm the presented certificate is unauthorized.
- Correlate the source IP presenting/receiving the invalid certificate with authentication logs to determine whether any administrator or VPN session succeeded within the anomaly window, and identify the account(s) involved.
- Determine whether the TLS anomaly targeted a management plane (SmartConsole/Gaia/API 443), a VPN gateway, or an endpoint client, as impact and containment differ per surface.
Containment
- Isolate or block the suspicious source IP at the perimeter and, if a management-plane session is implicated, terminate active administrator sessions and force re-authentication.
- Apply the vendor hotfix per sk1000117 to the affected Check Point products immediately, prioritizing internet-facing management and VPN gateways per CISA BOD 26-04 timelines.
- Rotate any credentials, VPN pre-shared keys, and certificates that may have transited a session accepted via the improper validation flaw.
Evidence Collection
- Preserve full Check Point logs (fw.log, SmartLog exports) and CEF/syslog covering the anomaly window, including the raw certificate payloads and TLS handshake records.
- Capture the presented certificate (PEM/DER), its fingerprint, and the negotiated cipher suite, plus PCAPs from the affected segment if network capture is available.
- Export authentication and configuration-change audit trails from the management server for the implicated accounts and time window.
Escalation Criteria
- !Escalate to incident response if an administrator or VPN authentication succeeded following an accepted invalid certificate, indicating probable session interception or credential compromise.
- !Escalate to leadership and CISA reporting channels if the affected asset is a federal HVA or falls under BOD 26-04, or if evidence shows configuration changes, policy pushes, or lateral movement following the event.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Check Point fw.log / SmartLog entries showing TLS handshake and certificate validation results - >
Presented X.509 certificate (subject, issuer, SAN, fingerprint) and negotiated cipher suite - >
Management server audit log entries for administrator logins and configuration/policy changes - >
VPN session establishment records and endpoint client connection logs
Tuning Guidance
Build an allowlist of known-good certificate fingerprints and issuing CAs for each Check Point management and gateway interface, and suppress events matching them. Exclude documented certificate-rotation and PKI-migration windows, and scope the authentication-correlation join to management/VPN ports (443, IPsec) to reduce noise from unrelated TLS anomalies. Lower confidence for sources on segments known to use self-signed lab certificates.
Hunting Queries
Baseline the volume and sources of Check Point certificate validation anomalies over time to distinguish sustained exploitation from isolated misconfiguration.
CommonSecurityLog | where DeviceVendor =~ "Check Point" | where AdditionalExtensions has_any ("self_signed","untrusted_ca","cn_mismatch","chain_incomplete") | summarize count() by SourceIP, DestinationIP, bin(TimeGenerated, 1h) | sort by count_ descindex=network sourcetype IN ("checkpoint:firewall","cp_log","opsec") (message="*untrusted_ca*" OR message="*cn_mismatch*" OR message="*self_signed*") | timechart span=1h count by src_ipAtomic Red Team Tests
Simulates a MITM tool presenting an untrusted self-signed certificate during a TLS handshake toward a Check Point Gaia/management interface to generate a certificate validation anomaly event.
Command
openssl req -x509 -newkey rsa:2048 -keyout /tmp/mitm.key -out /tmp/mitm.crt -days 1 -nodes -subj "/CN=cpmgmt.internal" && openssl s_server -cert /tmp/mitm.crt -key /tmp/mitm.key -accept 8443 -www & sleep 2 && echo | openssl s_client -connect 127.0.0.1:8443 -servername cpmgmt.internal 2>&1 | grep -i 'verify'Cleanup
pkill -f 's_server' ; rm -f /tmp/mitm.key /tmp/mitm.crtExpected Telemetry
TLS handshake logs showing an untrusted/self-signed certificate presented for the management interface hostname; verify error in client output.
Expected Detection
KQL/SPL certificate-anomaly queries flag a self_signed / untrusted_ca event for the target destination.
Generates a certificate whose CN does not match the requested Check Point gateway hostname to trigger a cn_mismatch validation event, emulating certificate substitution.
Command
openssl req -x509 -newkey rsa:2048 -keyout /tmp/mm.key -out /tmp/mm.crt -days 1 -nodes -subj "/CN=wrong-host.example" && openssl s_server -cert /tmp/mm.crt -key /tmp/mm.key -accept 8444 -www & sleep 2 && echo | openssl s_client -connect 127.0.0.1:8444 -servername cp-gw.internal 2>&1 | grep -iE 'CN|verify'Cleanup
pkill -f 's_server' ; rm -f /tmp/mm.key /tmp/mm.crtExpected Telemetry
Handshake record where certificate CN (wrong-host.example) differs from requested SNI (cp-gw.internal).
Expected Detection
Detection surfaces a cn_mismatch anomaly correlated to the gateway destination.
Chains an untrusted-certificate TLS session with a simulated administrator authentication attempt from the same source to exercise the correlation logic between certificate anomaly and follow-on login.
Command
powershell -NoProfile -Command "$ErrorActionPreference='SilentlyContinue'; [System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true}; try { Invoke-WebRequest -Uri 'https://cpmgmt.internal/web_api/login' -Method POST -Body '{\"user\":\"admin\",\"password\":\"lab-test\"}' -ContentType 'application/json' -TimeoutSec 5 } catch { $_.Exception.Message }"Cleanup
powershell -NoProfile -Command "[System.Net.ServicePointManager]::ServerCertificateValidationCallback=$null"Expected Telemetry
Outbound TLS connection to management API with certificate validation disabled, followed by an administrator login attempt in Check Point audit logs.
Expected Detection
Correlation rules (KQL join / EQL sequence / YARA-L match) fire on cert-anomaly-then-auth from the same source within the window.