What is the CVSS score of CVE-2026-48133?

CVE-2026-48133 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Check Point Quantum Security Gateway are affected by CVE-2026-48133?

Check Point Quantum Security Gateway systems with Identity Awareness and Browser-Based Authentication enabled are vulnerable to unauthenticated remote file disclosure.

How to fix or mitigate CVE-2026-48133?

Within 24 hours: audit inventory to identify Check Point Quantum Security Gateways with Browser-Based Authentication enabled; disable this feature if operationally feasible, or restrict network access to the appliance management interfaces. Within 7 days: implement enhanced logging and monitoring for exploitation attempts; establish network segmentation if not already in place to limit external exposure. Within 30 days: contact Check Point support for patch timelines and availability; conduct testing in non-production environment once vendor releases a fix.

Check Point Quantum Security Gateway CVE-2026-48133

EUVD-2026-31820 HIGH

PHP Remote File Inclusion (CWE-98)

2026-05-26 checkpoint

GHSA-fc4q-p6gg-r9rr

PHP Information Disclosure LFI Quantum Security Gateway

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 09:03 vuln.today

DescriptionCVE.org

When the Identity Awareness blade is enabled with Browser-Based Authentication, an unauthenticated user may be able to read certain internal files on the Security Gateway.

AnalysisAI

Unauthenticated information disclosure in Check Point Quantum Security Gateway allows remote attackers to read internal files on the appliance when the Identity Awareness blade is configured with Browser-Based Authentication. The flaw maps to CWE-98 (PHP file inclusion) and carries a CVSS 7.5 with confidentiality-only impact; EPSS is low (0.10%) and there is no public exploit identified at time of analysis, but the unauthenticated network reach against a perimeter gateway makes triage urgent for affected deployments.

Technical ContextAI

Check Point's Quantum Security Gateway exposes the Identity Awareness blade - a feature that maps network traffic to authenticated users - and one of its sub-features, Browser-Based Authentication (also marketed as Captive Portal), presents an HTTP/HTTPS web interface to end users. The vulnerability class (CWE-98, 'Improper Control of Filename for Include/Require Statement in PHP Program') combined with the 'PHP / LFI' tags indicates the captive portal's PHP-based web layer accepts user-controllable input that is reused in an include/require path, enabling local file inclusion. The CPE 'cpe:2.3:a:checkpoint:quantum_security_gateway' confirms the appliance product line is the affected component rather than a separate management or endpoint product.

RemediationAI

Patch available per vendor advisory: install the Jumbo Hotfix Accumulator that supersedes the affected Takes - specifically Take above 127 on R81.20, above 91 on R82, and above 19 on R82.10, and migrate off R81.10 and earlier branches per Check Point sk184993 (https://support.checkpoint.com/results/sk/sk184993). If patching cannot be scheduled immediately, the most direct compensating control is to disable Browser-Based Authentication within the Identity Awareness blade, or restrict access to the captive portal URL/port (typically 443/8443 on the gateway's portal IP) to known internal user subnets via the gateway's own rulebase - both will break end-user portal-based identity acquisition and may force fallback to AD Query or Identity Agents, so validate the identity-mapping path before applying. Monitor portal access logs for anomalous path-traversal style query strings as a detection backstop.