EUVD-2026-31820
GHSA-fc4q-p6gg-r9rr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Captive Portal
-
DeliveryCraft LFI request to portal endpoint
-
ExploitTrigger PHP include path traversal
-
ExecutionRead internal gateway files
-
ImpactHarvest credentials/config for pivot
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The Identity Awareness software blade must be enabled on the Security Gateway AND Browser-Based Authentication (Captive Portal) must be configured and reachable by the attacker - both are administrator-enabled features that are not on by default for a fresh gateway. The portal's HTTP/HTTPS listener (typically on the gateway's data-interface VIP) must be network-reachable from the attacker; no authentication, user interaction, or prior foothold is required (PR:N/UI:N). Limiting factors: gateways without Identity Awareness, or with Identity Awareness using only AD Query / Identity Agent / Terminal Server methods rather than Browser-Based Authentication, are not exploitable, and impact is restricted to reading 'certain internal files' per the vendor description rather than arbitrary filesystem read or code execution. |
| Impact | Signals are mixed but lean toward a meaningful exposure. CVSS vector AV:N/AC:L/PR:N/UI:N (network-reachable, low complexity, no auth, no user interaction) is consistent with classic LFI in a perimeter portal - exploitation is trivial once the portal is reachable. However, EPSS is only 0.10% (28th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis, suggesting the issue is not yet being broadcast or weaponized. Impact is bounded (C:H only; I:N/A:N) so this is read-only disclosure, not RCE - useful as a foothold (credentials, config, tokens) but not directly destructive. Note one tension worth verifying with the vendor: the issue is gated by 'Identity Awareness blade enabled with Browser-Based Authentication,' a non-default configuration, which reduces the population of exploitable instances despite the unauthenticated network vector. |
| Exploit ScenarioDerived | An external attacker scans for Check Point gateways exposing the Identity Awareness Captive Portal on the public interface, then issues a crafted HTTP request to the portal whose parameter is reused in a PHP include path, traversing into sensitive files such as gateway configuration, license data, or stored credentials. The disclosed contents are then used to pivot - for example, harvested credentials feed a follow-on VPN or management plane attack. No public exploit identified at time of analysis, but CWE-98 LFI patterns in PHP portals are well-understood and historically reproduced quickly once researchers examine the patch. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Unauthenticated information disclosure in Check Point Quantum Security Gateway allows remote attackers to read internal files on the appliance when the Identity Awareness blade is configured with Browser-Based Authentication. The flaw maps to CWE-98 (PHP file inclusion) and carries a CVSS 7.5 with confidentiality-only impact; EPSS is low (0.10%) and there is no public exploit identified at time of analysis, but the unauthenticated network reach against a perimeter gateway makes triage urgent for affected deployments.
RemediationAI
Patch available per vendor advisory: install the Jumbo Hotfix Accumulator that supersedes the affected Takes - specifically Take above 127 on R81.20, above 91 on R82, and above 19 on R82.10, and migrate off R81.10 and earlier branches per Check Point sk184993 (https://support.checkpoint.com/results/sk/sk184993). If patching cannot be scheduled immediately, the most direct compensating control is to disable Browser-Based Authentication within the Identity Awareness blade, or restrict access to the captive portal URL/port (typically 443/8443 on the gateway's portal IP) to known internal user subnets via the gateway's own rulebase - both will break end-user portal-based identity acquisition and may force fallback to AD Query or Identity Agents, so validate the identity-mapping path before applying. Monitor portal access logs for anomalous path-traversal style query strings as a detection backstop.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Check Point's Quantum Security Gateway exposes the Identity Awareness blade - a feature that maps network traffic to authenticated users - and one of its sub-features, Browser-Based Authentication (also marketed as Captive Portal), presents an HTTP/HTTPS web interface to end users. The vulnerability class (CWE-98, 'Improper Control of Filename for Include/Require Statement in PHP Program') combined with the 'PHP / LFI' tags indicates the captive portal's PHP-based web layer accepts user-controllable input that is reused in an include/require path, enabling local file inclusion. The CPE 'cpe:2.3:a:checkpoint:quantum_security_gateway' confirms the appliance product line is the affected component rather than a separate management or endpoint product.
Know when Checkpoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (checkpoint) · only source for this CVE.
CVSS VectorVendor: checkpoint
DescriptionCVE.org
When the Identity Awareness blade is enabled with Browser-Based Authentication, an unauthenticated user may be able to read certain internal files on the Security Gateway.
Executive ViewAI
Check Point Quantum Security Gateway systems with Identity Awareness and Browser-Based Authentication enabled are vulnerable to unauthenticated remote file disclosure. Attackers without credentials can read sensitive internal configuration files on the appliance, potentially exposing credentials, encryption keys, and operational intelligence that defend your network perimeter. All affected deployments require immediate assessment and remediation planning.
No vendor-released patch identified at time of analysis. Interim mitigations: disable Browser-Based Authentication feature if not operationally critical; restrict administrative access to Quantum Security Gateway appliances to trusted networks only; implement or enhance network segmentation to minimize perimeter appliance exposure; monitor and review access logs for suspicious file access patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Exploit-DB