What is the CVSS score of CVE-2026-48134?

CVE-2026-48134 has a CVSS 3.1 base score of 5.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Quantum Security Gateway CVE-2026-48134

EUVD-2026-31821 MEDIUM

SQL Injection (CWE-89)

2026-05-26 checkpoint

GHSA-22vq-6hm4-vrwc

SQLi Quantum Security Gateway

5.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.6 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 12:18 vuln.today

Severity Changed

May 26, 2026 - 15:22 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 15:22 NVD

7.6 (HIGH) 5.6 (MEDIUM)

DescriptionCVE.org

When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access the UserCheck Ask page could attempt to manipulate the Security Gateway's stored DLP/UserCheck incident information. This could lead to disruptions such as loss of stored incident entries, incorrect handling of pending approvals, or resource impact if the issue is abused repeatedly. Exposure is reduced if the UserCheck Portal is not accessible from untrusted networks.

AnalysisAI

SQL injection in Check Point Quantum Security Gateway's UserCheck Web Portal allows a remote unauthenticated attacker who can reach the UserCheck Ask page to manipulate the Security Gateway's stored DLP incident database when the DLP blade is active. Successful exploitation can cause loss of stored incident entries, disruption of pending approval workflows, or resource exhaustion through repeated abuse - all of which could undermine the integrity of an organization's data loss prevention audit trail. No public exploit code has been identified and EPSS is very low at 0.06% (18th percentile), with no CISA KEV listing at time of analysis.

Technical ContextAI

The affected component is the UserCheck Web Portal's UserChoice flow - an end-user-facing interface embedded in Check Point Quantum Security Gateway that allows employees to interact with DLP-triggered security events such as justifying, approving, or reporting data sharing attempts. CWE-89 (SQL Injection) confirms the root cause: the portal fails to properly sanitize or parameterize user-supplied input before constructing SQL queries, enabling an attacker to alter the queries executed against the Security Gateway's internal DLP/UserCheck incident data store. This is a server-side injection flaw in a security appliance's self-service portal, not a client-side issue. The CPE cpe:2.3:a:checkpoint:quantum_security_gateway:*:*:*:*:*:*:*:* confirms the vulnerability spans the entire Quantum Security Gateway product line across multiple major release trains. The vulnerability is conditional on the DLP blade being licensed and active, meaning it is not present in all deployments.

RemediationAI

Apply the vendor-released Jumbo Hotfix for your release train: for R82.10, upgrade to Jumbo Hotfix Take 20 or above; for R81.20, upgrade to Jumbo Hotfix Take 128 or above; for R82, upgrade to Jumbo Hotfix Take 92 or above. Gateways running R81.10 or earlier are on end-of-life or near-EOL code paths and should be upgraded to a supported release receiving current hotfix coverage before applying the relevant take. Consult the Check Point advisory at https://support.checkpoint.com/results/sk/sk184983 for exact take numbers, download links, and upgrade prerequisites. As an immediate compensating control prior to patching, restrict network access to the UserCheck Web Portal so it is unreachable from untrusted networks - implement firewall rules or network segmentation ensuring only internal or VPN-authenticated hosts can reach the portal. The vendor explicitly identifies this as a meaningful risk reduction. Note that this control does not eliminate the underlying SQL injection vulnerability and should not substitute for patching; it does, however, remove the unauthenticated network attack surface until the Jumbo Hotfix can be applied.