{
  "document" : {
    "aggregate_severity" : {
      "text" : "kritisch"
    },
    "category" : "csaf_base",
    "csaf_version" : "2.0",
    "distribution" : {
      "tlp" : {
        "label" : "WHITE",
        "url" : "https://www.first.org/tlp/"
      }
    },
    "lang" : "de-DE",
    "notes" : [ {
      "category" : "legal_disclaimer",
      "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen."
    }, {
      "category" : "description",
      "text" : "Check Point Security Gateway ist eine \"Next Generation Firewall\" Produktfamilie.\r\nDie Check Point Spark Firewall ist ein All-in-One-Cybersicherheits-Gateway.\r\nEine vereinheitlichte Plattform zur Verwaltung von Sicherheitsrichtlinien, Überwachung des Netzwerkverkehrs und Bereitstellung von Sicherheits-Gateways in der Infrastruktur einer Organisation.",
      "title" : "Produktbeschreibung"
    }, {
      "category" : "summary",
      "text" : "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Check Point Security Gateway, Check Point Spark Firewall und Check Point Security Management ausnutzen, um beliebigen Programmcode auszuführen.",
      "title" : "Angriff"
    }, {
      "category" : "general",
      "text" : "- Appliance\n- Windows",
      "title" : "Betroffene Betriebssysteme"
    } ],
    "publisher" : {
      "category" : "other",
      "contact_details" : "csaf-provider@cert-bund.de",
      "name" : "Bundesamt für Sicherheit in der Informationstechnik",
      "namespace" : "https://www.bsi.bund.de"
    },
    "references" : [ {
      "category" : "self",
      "summary" : "WID-SEC-W-2026-3305 - CSAF Version",
      "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3305.json"
    }, {
      "category" : "self",
      "summary" : "WID-SEC-2026-3305 - Portal Version",
      "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3305"
    }, {
      "category" : "external",
      "summary" : "Checkpoint Security Advisory vom 2026-09-09",
      "url" : "https://support.checkpoint.com/results/sk/sk1000117"
    }, {
      "category" : "external",
      "summary" : "Checkpoint Security Advisory vom 2026-09-09",
      "url" : "https://support.checkpoint.com/results/sk/sk1000118"
    }, {
      "category" : "external",
      "summary" : "Exploit",
      "url" : "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/amp/"
    } ],
    "source_lang" : "en-US",
    "title" : "Check Point Security Gateway, Spark Firewall und Security Management: Mehrere Schwachstellen ermöglichen Codeausführung",
    "tracking" : {
      "current_release_date" : "2026-09-22T22:00:00.000+00:00",
      "generator" : {
        "date" : "2026-09-23T07:04:28.172+00:00",
        "engine" : {
          "name" : "BSI-WID",
          "version" : "1.6.0"
        }
      },
      "id" : "WID-SEC-W-2026-3305",
      "initial_release_date" : "2026-09-09T22:00:00.000+00:00",
      "revision_history" : [ {
        "date" : "2026-09-09T22:00:00.000+00:00",
        "number" : "1",
        "summary" : "Initiale Fassung"
      }, {
        "date" : "2026-09-13T22:00:00.000+00:00",
        "number" : "2",
        "summary" : "Weitere gefixte Versionen ergänzt"
      }, {
        "date" : "2026-09-22T22:00:00.000+00:00",
        "number" : "3",
        "summary" : "Exploit CVE-2026-85102"
      } ],
      "status" : "final",
      "version" : "3"
    }
  },
  "product_tree" : {
    "branches" : [ {
      "branches" : [ {
        "branches" : [ {
          "category" : "product_version_range",
          "name" : "R82.10 <Take 24",
          "product" : {
            "name" : "Check Point Security Gateway R82.10 <Take 24",
            "product_id" : "T059300"
          }
        }, {
          "category" : "product_version",
          "name" : "R82.10 Take 24",
          "product" : {
            "name" : "Check Point Security Gateway R82.10 Take 24",
            "product_id" : "T059300-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/h:checkpoint:security_gateway:r82.10__take_24"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R82 <Take 24",
          "product" : {
            "name" : "Check Point Security Gateway R82 <Take 24",
            "product_id" : "T059301"
          }
        }, {
          "category" : "product_version",
          "name" : "R82 Take 24",
          "product" : {
            "name" : "Check Point Security Gateway R82 Take 24",
            "product_id" : "T059301-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/h:checkpoint:security_gateway:r82__take_24"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R81.20 <Take 24",
          "product" : {
            "name" : "Check Point Security Gateway R81.20 <Take 24",
            "product_id" : "T059302"
          }
        }, {
          "category" : "product_version",
          "name" : "R81.20 Take 24",
          "product" : {
            "name" : "Check Point Security Gateway R81.20 Take 24",
            "product_id" : "T059302-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/h:checkpoint:security_gateway:r81.20__take_24"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R82.10 <Jumbo Hotfix Take 44",
          "product" : {
            "name" : "Check Point Security Gateway R82.10 <Jumbo Hotfix Take 44",
            "product_id" : "T059434"
          }
        }, {
          "category" : "product_version",
          "name" : "R82.10 Jumbo Hotfix Take 44",
          "product" : {
            "name" : "Check Point Security Gateway R82.10 Jumbo Hotfix Take 44",
            "product_id" : "T059434-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/h:checkpoint:security_gateway:r82.10__jumbo_hotfix_take_44"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R82 <Jumbo Hotfix Take 126",
          "product" : {
            "name" : "Check Point Security Gateway R82 <Jumbo Hotfix Take 126",
            "product_id" : "T059437"
          }
        }, {
          "category" : "product_version",
          "name" : "R82 Jumbo Hotfix Take 126",
          "product" : {
            "name" : "Check Point Security Gateway R82 Jumbo Hotfix Take 126",
            "product_id" : "T059437-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/h:checkpoint:security_gateway:r82__jumbo_hotfix_take_126"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R81.20 <Jumbo Hotfix Take 166",
          "product" : {
            "name" : "Check Point Security Gateway R81.20 <Jumbo Hotfix Take 166",
            "product_id" : "T059440"
          }
        }, {
          "category" : "product_version",
          "name" : "R81.20 Jumbo Hotfix Take 166",
          "product" : {
            "name" : "Check Point Security Gateway R81.20 Jumbo Hotfix Take 166",
            "product_id" : "T059440-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/h:checkpoint:security_gateway:r81.20__jumbo_hotfix_take_166"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R82.10 <Take 26",
          "product" : {
            "name" : "Check Point Security Gateway R82.10 <Take 26",
            "product_id" : "T059972"
          }
        }, {
          "category" : "product_version",
          "name" : "R82.10 Take 26",
          "product" : {
            "name" : "Check Point Security Gateway R82.10 Take 26",
            "product_id" : "T059972-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/h:checkpoint:security_gateway:r82.10__take_26"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R82 <Take 26",
          "product" : {
            "name" : "Check Point Security Gateway R82 <Take 26",
            "product_id" : "T059973"
          }
        }, {
          "category" : "product_version",
          "name" : "R82 Take 26",
          "product" : {
            "name" : "Check Point Security Gateway R82 Take 26",
            "product_id" : "T059973-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/h:checkpoint:security_gateway:r82__take_26"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R81.20 <Take 26",
          "product" : {
            "name" : "Check Point Security Gateway R81.20 <Take 26",
            "product_id" : "T059974"
          }
        }, {
          "category" : "product_version",
          "name" : "R81.20 Take 26",
          "product" : {
            "name" : "Check Point Security Gateway R81.20 Take 26",
            "product_id" : "T059974-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/h:checkpoint:security_gateway:r81.20__take_26"
            }
          }
        } ],
        "category" : "product_name",
        "name" : "Security Gateway"
      }, {
        "branches" : [ {
          "category" : "product_version_range",
          "name" : "Server R82.10 <Take 24",
          "product" : {
            "name" : "Check Point Security Management Server R82.10 <Take 24",
            "product_id" : "T059306"
          }
        }, {
          "category" : "product_version",
          "name" : "Server R82.10 Take 24",
          "product" : {
            "name" : "Check Point Security Management Server R82.10 Take 24",
            "product_id" : "T059306-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:security_management:server_r82.10__take_24"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "Server R82 <Take 24",
          "product" : {
            "name" : "Check Point Security Management Server R82 <Take 24",
            "product_id" : "T059307"
          }
        }, {
          "category" : "product_version",
          "name" : "Server R82 Take 24",
          "product" : {
            "name" : "Check Point Security Management Server R82 Take 24",
            "product_id" : "T059307-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:security_management:server_r82__take_24"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "Server R81.20 <Take 24",
          "product" : {
            "name" : "Check Point Security Management Server R81.20 <Take 24",
            "product_id" : "T059308"
          }
        }, {
          "category" : "product_version",
          "name" : "Server R81.20 Take 24",
          "product" : {
            "name" : "Check Point Security Management Server R81.20 Take 24",
            "product_id" : "T059308-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:security_management:server_r81.20__take_24"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "Server R82.10 <Jumbo Hotfix Take 44",
          "product" : {
            "name" : "Check Point Security Management Server R82.10 <Jumbo Hotfix Take 44",
            "product_id" : "T059435"
          }
        }, {
          "category" : "product_version",
          "name" : "Server R82.10 Jumbo Hotfix Take 44",
          "product" : {
            "name" : "Check Point Security Management Server R82.10 Jumbo Hotfix Take 44",
            "product_id" : "T059435-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:security_management:server_r82.10__jumbo_hotfix_take_44"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "Server R82 <Jumbo Hotfix Take 126",
          "product" : {
            "name" : "Check Point Security Management Server R82 <Jumbo Hotfix Take 126",
            "product_id" : "T059438"
          }
        }, {
          "category" : "product_version",
          "name" : "Server R82 Jumbo Hotfix Take 126",
          "product" : {
            "name" : "Check Point Security Management Server R82 Jumbo Hotfix Take 126",
            "product_id" : "T059438-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:security_management:server_r82__jumbo_hotfix_take_126"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "Server R81.20 <Jumbo Hotfix Take 166",
          "product" : {
            "name" : "Check Point Security Management Server R81.20 <Jumbo Hotfix Take 166",
            "product_id" : "T059441"
          }
        }, {
          "category" : "product_version",
          "name" : "Server R81.20 Jumbo Hotfix Take 166",
          "product" : {
            "name" : "Check Point Security Management Server R81.20 Jumbo Hotfix Take 166",
            "product_id" : "T059441-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:security_management:server_r81.20__jumbo_hotfix_take_166"
            }
          }
        } ],
        "category" : "product_name",
        "name" : "Security Management"
      }, {
        "branches" : [ {
          "category" : "product_version_range",
          "name" : "R82.10 <Take 24",
          "product" : {
            "name" : "Check Point Spark Firewall R82.10 <Take 24",
            "product_id" : "T059303"
          }
        }, {
          "category" : "product_version",
          "name" : "R82.10 Take 24",
          "product" : {
            "name" : "Check Point Spark Firewall R82.10 Take 24",
            "product_id" : "T059303-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:spark_firewall:r82.10__take_24"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R82 <Take 24",
          "product" : {
            "name" : "Check Point Spark Firewall R82 <Take 24",
            "product_id" : "T059304"
          }
        }, {
          "category" : "product_version",
          "name" : "R82 Take 24",
          "product" : {
            "name" : "Check Point Spark Firewall R82 Take 24",
            "product_id" : "T059304-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:spark_firewall:r82__take_24"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R81.20 <Take 24",
          "product" : {
            "name" : "Check Point Spark Firewall R81.20 <Take 24",
            "product_id" : "T059305"
          }
        }, {
          "category" : "product_version",
          "name" : "R81.20 Take 24",
          "product" : {
            "name" : "Check Point Spark Firewall R81.20 Take 24",
            "product_id" : "T059305-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:spark_firewall:r81.20__take_24"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R82.10 <Jumbo Hotfix Take 44",
          "product" : {
            "name" : "Check Point Spark Firewall R82.10 <Jumbo Hotfix Take 44",
            "product_id" : "T059436"
          }
        }, {
          "category" : "product_version",
          "name" : "R82.10 Jumbo Hotfix Take 44",
          "product" : {
            "name" : "Check Point Spark Firewall R82.10 Jumbo Hotfix Take 44",
            "product_id" : "T059436-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:spark_firewall:r82.10__jumbo_hotfix_take_44"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R82 <Jumbo Hotfix Take 126",
          "product" : {
            "name" : "Check Point Spark Firewall R82 <Jumbo Hotfix Take 126",
            "product_id" : "T059439"
          }
        }, {
          "category" : "product_version",
          "name" : "R82 Jumbo Hotfix Take 126",
          "product" : {
            "name" : "Check Point Spark Firewall R82 Jumbo Hotfix Take 126",
            "product_id" : "T059439-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:spark_firewall:r82__jumbo_hotfix_take_126"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R81.20 <Jumbo Hotfix Take 166",
          "product" : {
            "name" : "Check Point Spark Firewall R81.20 <Jumbo Hotfix Take 166",
            "product_id" : "T059442"
          }
        }, {
          "category" : "product_version",
          "name" : "R81.20 Jumbo Hotfix Take 166",
          "product" : {
            "name" : "Check Point Spark Firewall R81.20 Jumbo Hotfix Take 166",
            "product_id" : "T059442-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:spark_firewall:r81.20__jumbo_hotfix_take_166"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R82.00.10 <Build 2325",
          "product" : {
            "name" : "Check Point Spark Firewall R82.00.10 <Build 2325",
            "product_id" : "T059443"
          }
        }, {
          "category" : "product_version",
          "name" : "R82.00.10 Build 2325",
          "product" : {
            "name" : "Check Point Spark Firewall R82.00.10 Build 2325",
            "product_id" : "T059443-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:spark_firewall:r82.00.10__build_2325"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R81.10.17 <Build 4968",
          "product" : {
            "name" : "Check Point Spark Firewall R81.10.17 <Build 4968",
            "product_id" : "T059444"
          }
        }, {
          "category" : "product_version",
          "name" : "R81.10.17 Build 4968",
          "product" : {
            "name" : "Check Point Spark Firewall R81.10.17 Build 4968",
            "product_id" : "T059444-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:spark_firewall:r81.10.17__build_4968"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R82.10 <Take 26",
          "product" : {
            "name" : "Check Point Spark Firewall R82.10 <Take 26",
            "product_id" : "T059969"
          }
        }, {
          "category" : "product_version",
          "name" : "R82.10 Take 26",
          "product" : {
            "name" : "Check Point Spark Firewall R82.10 Take 26",
            "product_id" : "T059969-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:spark_firewall:r82.10__take_26"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R82 <Take 26",
          "product" : {
            "name" : "Check Point Spark Firewall R82 <Take 26",
            "product_id" : "T059970"
          }
        }, {
          "category" : "product_version",
          "name" : "R82 Take 26",
          "product" : {
            "name" : "Check Point Spark Firewall R82 Take 26",
            "product_id" : "T059970-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:spark_firewall:r82__take_26"
            }
          }
        }, {
          "category" : "product_version_range",
          "name" : "R81.20 <Take 26",
          "product" : {
            "name" : "Check Point Spark Firewall R81.20 <Take 26",
            "product_id" : "T059971"
          }
        }, {
          "category" : "product_version",
          "name" : "R81.20 Take 26",
          "product" : {
            "name" : "Check Point Spark Firewall R81.20 Take 26",
            "product_id" : "T059971-fixed",
            "product_identification_helper" : {
              "cpe" : "cpe:/a:checkpoint:spark_firewall:r81.20__take_26"
            }
          }
        } ],
        "category" : "product_name",
        "name" : "Spark Firewall"
      } ],
      "category" : "vendor",
      "name" : "Check Point"
    } ]
  },
  "vulnerabilities" : [ {
    "cve" : "CVE-2026-85102",
    "product_status" : {
      "known_affected" : [ "T059438", "T059305", "T059437", "T059439", "T059969", "T059441", "T059440", "T059300", "T059443", "T059971", "T059442", "T059970", "T059302", "T059434", "T059973", "T059301", "T059444", "T059972", "T059304", "T059436", "T059303", "T059435", "T059974" ]
    },
    "release_date" : "2026-09-09T22:00:00.000+00:00",
    "title" : "CVE-2026-85102"
  }, {
    "cve" : "CVE-2026-85103",
    "product_status" : {
      "known_affected" : [ "T059306", "T059305", "T059308", "T059307", "T059969", "T059441", "T059440", "T059300", "T059443", "T059442", "T059302", "T059301", "T059444", "T059304", "T059303", "T059438", "T059437", "T059439", "T059971", "T059970", "T059973", "T059434", "T059972", "T059436", "T059974", "T059435" ]
    },
    "release_date" : "2026-09-09T22:00:00.000+00:00",
    "title" : "CVE-2026-85103"
  } ]
}