Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires an existing read-only portal account (PR:L) reachable over the network (AV:N); vendor-rated non-trivial technique (AC:H) yielding full root control (C:H/I:H/A:H) within the same host (S:U).
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.
AnalysisAI
Privilege escalation in Check Point Gaia Portal allows an authenticated user holding only read-only administrative privileges to execute arbitrary commands as root, giving full compromise of the affected Quantum Security Gateway or Security Management appliance. The flaw (CWE-269, improper privilege management) is vendor-reported via advisory sk185153 and carries a CVSS 3.1 base score of 7.5 with high attack complexity. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
Gaia is Check Point's unified security operating system, and the Gaia Portal is its web-based management interface used to administer Quantum Security Gateway (firewall/enforcement) and Quantum Security Management (centralized policy management) appliances. The root cause is CWE-269 (Improper Privilege Management): the portal's role-based access control fails to properly confine a read-only administrator, allowing that low-privileged web role to cross the boundary into the underlying Gaia OS shell and run commands as root. The affected CPEs are cpe:2.3:a:checkpoint:quantum_security_gateway and cpe:2.3:a:checkpoint:quantum_security_management, indicating both the enforcement and management planes of the Quantum product line are in scope.
RemediationAI
Apply the fix and guidance published in Check Point advisory sk185153 (https://support.checkpoint.com/results/sk/sk185153); patch available per vendor advisory, but an exact fixed version/Jumbo Hotfix Take was not provided in the input data and must be read directly from that advisory. As compensating controls until patched, restrict who is granted read-only Gaia Portal accounts and audit existing role assignments, since the exploit requires such an account; limit network reachability of the Gaia Portal management interface to a dedicated management network or jump host and block it from general user/internet segments (trade-off: administrators must connect via the management path); and enable and monitor logging for unexpected shell/command execution or privilege transitions originating from read-only accounts. These controls reduce exposure but do not eliminate the flaw, so patching per sk185153 remains the primary action.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-47702
GHSA-jh99-mm75-xrmv