CVE-2026-85102 IBM QRadar · QRadar

Detect CVE-2026-85102: Check Point Multiple Products Improper Certificate Validation Exploitation in IBM QRadar

Detects exploitation and post-exploitation activity associated with CVE-2026-85102, an improper certificate validation vulnerability (CWE-295) affecting multiple Check Point products. The flaw allows an attacker to present forged or mismatched TLS certificates that Check Point components accept without proper validation, enabling machine-in-the-middle interception of management/VPN/gateway sessions, credential capture, and unauthorized session establishment. This CVE is listed in the CISA KEV catalog and is subject to BOD 26-04 remediation timelines. Detection focuses on TLS anomalies (self-signed/untrusted CA chains, certificate CN/SAN mismatches, sudden fingerprint changes) toward Check Point management and gateway interfaces, anomalous administrator/VPN authentication following such TLS events, and configuration or firmware activity indicative of exploitation.

MITRE ATT&CK

Tactic
Initial Access Credential Access Collection

QRadar Detection Query

IBM QRadar (QRadar)
sql 
SELECT sourceip, destinationip, destinationport, "Cert Anomaly Type" AS cert_anomaly, username, COUNT(*) AS event_count, MIN(startTime) AS first_seen, MAX(startTime) AS last_seen FROM events WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%Check Point%' AND (QIDNAME(qid) ILIKE '%certificate%' OR QIDNAME(qid) ILIKE '%TLS%' OR QIDNAME(qid) ILIKE '%handshake%') AND (payload ILIKE '%self_signed%' OR payload ILIKE '%untrusted_ca%' OR payload ILIKE '%cn_mismatch%' OR payload ILIKE '%cert_validation_failed%' OR payload ILIKE '%chain_incomplete%') GROUP BY sourceip, destinationip, destinationport, cert_anomaly, username ORDER BY event_count DESC LAST 24 HOURS
high severity medium confidence

QRadar AQL query surfacing Check Point log sources emitting certificate validation anomaly payloads, grouped by source/destination to identify potential MITM exploitation of CVE-2026-85102.

Data Sources

Check Point QRadar DSMTLS event payloads

Required Tables

events

False Positives & Tuning

  • QID mappings that classify benign certificate renewal notices as validation failures
  • Vulnerability scanners probing management interfaces with malformed certificates
  • Internal CA rollout producing transient untrusted-chain events

Other platforms for CVE-2026-85102

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Present self-signed certificate to Check Point management interface

    Expected signal: TLS handshake logs showing an untrusted/self-signed certificate presented for the management interface hostname; verify error in client output.

  2. Test 2CN/SAN mismatch certificate presentation

    Expected signal: Handshake record where certificate CN (wrong-host.example) differs from requested SNI (cp-gw.internal).

  3. Test 3Invalid certificate acceptance followed by simulated admin login

    Expected signal: Outbound TLS connection to management API with certificate validation disabled, followed by an administrator login attempt in Check Point audit logs.

Last updated: 2026-09-23 Research depth: standard
References (4)

Response Playbook

Triage

  1. Confirm the affected Check Point product and version against sk1000117 and determine whether the fixed hotfix/JHF has been applied to the source gateway, management server, or endpoint client.
  2. Review the certificate anomaly details (subject CN/SAN, issuer, fingerprint) from the alert and compare against the organization's known-good certificate inventory for that Check Point interface to confirm the presented certificate is unauthorized.
  3. Correlate the source IP presenting/receiving the invalid certificate with authentication logs to determine whether any administrator or VPN session succeeded within the anomaly window, and identify the account(s) involved.
  4. Determine whether the TLS anomaly targeted a management plane (SmartConsole/Gaia/API 443), a VPN gateway, or an endpoint client, as impact and containment differ per surface.

Containment

  1. Isolate or block the suspicious source IP at the perimeter and, if a management-plane session is implicated, terminate active administrator sessions and force re-authentication.
  2. Apply the vendor hotfix per sk1000117 to the affected Check Point products immediately, prioritizing internet-facing management and VPN gateways per CISA BOD 26-04 timelines.
  3. Rotate any credentials, VPN pre-shared keys, and certificates that may have transited a session accepted via the improper validation flaw.

Evidence Collection

  1. Preserve full Check Point logs (fw.log, SmartLog exports) and CEF/syslog covering the anomaly window, including the raw certificate payloads and TLS handshake records.
  2. Capture the presented certificate (PEM/DER), its fingerprint, and the negotiated cipher suite, plus PCAPs from the affected segment if network capture is available.
  3. Export authentication and configuration-change audit trails from the management server for the implicated accounts and time window.

Escalation Criteria

  • !Escalate to incident response if an administrator or VPN authentication succeeded following an accepted invalid certificate, indicating probable session interception or credential compromise.
  • !Escalate to leadership and CISA reporting channels if the affected asset is a federal HVA or falls under BOD 26-04, or if evidence shows configuration changes, policy pushes, or lateral movement following the event.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Check Point fw.log / SmartLog entries showing TLS handshake and certificate validation results
  • >Presented X.509 certificate (subject, issuer, SAN, fingerprint) and negotiated cipher suite
  • >Management server audit log entries for administrator logins and configuration/policy changes
  • >VPN session establishment records and endpoint client connection logs

Tuning Guidance

Build an allowlist of known-good certificate fingerprints and issuing CAs for each Check Point management and gateway interface, and suppress events matching them. Exclude documented certificate-rotation and PKI-migration windows, and scope the authentication-correlation join to management/VPN ports (443, IPsec) to reduce noise from unrelated TLS anomalies. Lower confidence for sources on segments known to use self-signed lab certificates.

Hunting Queries

Baseline the volume and sources of Check Point certificate validation anomalies over time to distinguish sustained exploitation from isolated misconfiguration.

Hunting — KQL
kql 
CommonSecurityLog | where DeviceVendor =~ "Check Point" | where AdditionalExtensions has_any ("self_signed","untrusted_ca","cn_mismatch","chain_incomplete") | summarize count() by SourceIP, DestinationIP, bin(TimeGenerated, 1h) | sort by count_ desc
Hunting — SPL
spl 
index=network sourcetype IN ("checkpoint:firewall","cp_log","opsec") (message="*untrusted_ca*" OR message="*cn_mismatch*" OR message="*self_signed*") | timechart span=1h count by src_ip

Atomic Red Team Tests

Test 1 Present self-signed certificate to Check Point management interface
linux

Simulates a MITM tool presenting an untrusted self-signed certificate during a TLS handshake toward a Check Point Gaia/management interface to generate a certificate validation anomaly event.

Command

bash 
openssl req -x509 -newkey rsa:2048 -keyout /tmp/mitm.key -out /tmp/mitm.crt -days 1 -nodes -subj "/CN=cpmgmt.internal" && openssl s_server -cert /tmp/mitm.crt -key /tmp/mitm.key -accept 8443 -www & sleep 2 && echo | openssl s_client -connect 127.0.0.1:8443 -servername cpmgmt.internal 2>&1 | grep -i 'verify'

Cleanup

bash 
pkill -f 's_server' ; rm -f /tmp/mitm.key /tmp/mitm.crt

Expected Telemetry

TLS handshake logs showing an untrusted/self-signed certificate presented for the management interface hostname; verify error in client output.

Expected Detection

KQL/SPL certificate-anomaly queries flag a self_signed / untrusted_ca event for the target destination.

Test 2 CN/SAN mismatch certificate presentation
linux

Generates a certificate whose CN does not match the requested Check Point gateway hostname to trigger a cn_mismatch validation event, emulating certificate substitution.

Command

bash 
openssl req -x509 -newkey rsa:2048 -keyout /tmp/mm.key -out /tmp/mm.crt -days 1 -nodes -subj "/CN=wrong-host.example" && openssl s_server -cert /tmp/mm.crt -key /tmp/mm.key -accept 8444 -www & sleep 2 && echo | openssl s_client -connect 127.0.0.1:8444 -servername cp-gw.internal 2>&1 | grep -iE 'CN|verify'

Cleanup

bash 
pkill -f 's_server' ; rm -f /tmp/mm.key /tmp/mm.crt

Expected Telemetry

Handshake record where certificate CN (wrong-host.example) differs from requested SNI (cp-gw.internal).

Expected Detection

Detection surfaces a cn_mismatch anomaly correlated to the gateway destination.

Test 3 Invalid certificate acceptance followed by simulated admin login
windows

Chains an untrusted-certificate TLS session with a simulated administrator authentication attempt from the same source to exercise the correlation logic between certificate anomaly and follow-on login.

Command

powershell 
powershell -NoProfile -Command "$ErrorActionPreference='SilentlyContinue'; [System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true}; try { Invoke-WebRequest -Uri 'https://cpmgmt.internal/web_api/login' -Method POST -Body '{\"user\":\"admin\",\"password\":\"lab-test\"}' -ContentType 'application/json' -TimeoutSec 5 } catch { $_.Exception.Message }"

Cleanup

powershell 
powershell -NoProfile -Command "[System.Net.ServicePointManager]::ServerCertificateValidationCallback=$null"

Expected Telemetry

Outbound TLS connection to management API with certificate validation disabled, followed by an administrator login attempt in Check Point audit logs.

Expected Detection

Correlation rules (KQL join / EQL sequence / YARA-L match) fire on cert-anomaly-then-auth from the same source within the window.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0006Credential AccessTA0009Collection

Related Techniques

T1557Adversary-in-the-MiddleT1040Network SniffingT1556Modify Authentication Process

Same Tactic: Initial Access

Popular Detections