Skip to main content

Check Point Gaia CVE-2026-62145

| EUVDEUVD-2026-47702 HIGH
Improper Privilege Management (CWE-269)
2026-07-22 checkpoint GHSA-jh99-mm75-xrmv
7.5
CVSS 3.1 · Vendor: checkpoint
Share

Severity by source

Vendor (checkpoint) PRIMARY
7.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Requires an existing read-only portal account (PR:L) reachable over the network (AV:N); vendor-rated non-trivial technique (AC:H) yielding full root control (C:H/I:H/A:H) within the same host (S:U).

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (checkpoint).

CVSS VectorVendor: checkpoint

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 22, 2026 - 14:35 vuln.today
CVE Published
Jul 22, 2026 - 13:53 cve.org
HIGH 7.5

DescriptionCVE.org

A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.

AnalysisAI

Privilege escalation in Check Point Gaia Portal allows an authenticated user holding only read-only administrative privileges to execute arbitrary commands as root, giving full compromise of the affected Quantum Security Gateway or Security Management appliance. The flaw (CWE-269, improper privilege management) is vendor-reported via advisory sk185153 and carries a CVSS 3.1 base score of 7.5 with high attack complexity. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Gaia is Check Point's unified security operating system, and the Gaia Portal is its web-based management interface used to administer Quantum Security Gateway (firewall/enforcement) and Quantum Security Management (centralized policy management) appliances. The root cause is CWE-269 (Improper Privilege Management): the portal's role-based access control fails to properly confine a read-only administrator, allowing that low-privileged web role to cross the boundary into the underlying Gaia OS shell and run commands as root. The affected CPEs are cpe:2.3:a:checkpoint:quantum_security_gateway and cpe:2.3:a:checkpoint:quantum_security_management, indicating both the enforcement and management planes of the Quantum product line are in scope.

RemediationAI

Apply the fix and guidance published in Check Point advisory sk185153 (https://support.checkpoint.com/results/sk/sk185153); patch available per vendor advisory, but an exact fixed version/Jumbo Hotfix Take was not provided in the input data and must be read directly from that advisory. As compensating controls until patched, restrict who is granted read-only Gaia Portal accounts and audit existing role assignments, since the exploit requires such an account; limit network reachability of the Gaia Portal management interface to a dedicated management network or jump host and block it from general user/internet segments (trade-off: administrators must connect via the management path); and enable and monitor logging for unexpected shell/command execution or privilege transitions originating from read-only accounts. These controls reduce exposure but do not eliminate the flaw, so patching per sk185153 remains the primary action.

CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which

CVE-2024-24919 HIGH POC
8.6 May 28

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte

CVE-2014-7169 CRITICAL POC
9.8 Sep 25

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of

CVE-2017-1000083 HIGH POC
7.8 Sep 05

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e

CVE-2026-16232 CRITICAL POC
9.3 Jul 22

Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid

CVE-2026-50751 CRITICAL POC
9.3 Jun 08

Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker

CVE-2026-85103 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu

CVE-2026-85102 CRITICAL POC
9.8 Sep 09

Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V

CVE-2024-3568 CRITICAL POC
9.6 Apr 10

The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data

CVE-2026-24747 HIGH POC
8.8 Jan 27

PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]

CVE-2022-41604 HIGH POC
8.8 Sep 27

Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever

CVE-2026-58659 HIGH POC
8.4 Jul 15

Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che

Share

CVE-2026-62145 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy