Quantum Security Management EUVD-2026-31823

The Compliance feature must be explicitly enabled on Check Point Multi-Domain Management - this is a non-default or separately licensed module, not active in all deployments. The attacker must be an authenticated administrator (PR:H) holding read-write access to at least one Management Domain CMA; read-only CMA administrators or lower-privileged accounts are not confirmed as viable vectors based on the description. High attack complexity (AC:H) indicates the SQL injection likely requires precise payload construction, possibly with knowledge of the target domain's metadata table structure. The impact is limited to the Compliance Best Practices metadata store - it does not affect firewall policy, gateway configurations, or authentication systems. Limiting factors include: mandatory pre-authentication as a high-privilege CMA admin, enabled Compliance feature, high exploit complexity, and unchanged scope preventing lateral movement beyond the metadata store.

The CVSS 4.1 (Medium) score reflects a meaningfully constrained threat profile: PR:H (High privileges required) means an attacker must already possess authenticated administrator credentials with read-write access to at least one CMA - a significant pre-requisite that eliminates external, unauthenticated threat actors. AC:H (High complexity) further indicates exploitation is non-trivial, likely requiring precise crafting of the SQL payload and specific knowledge of the target domain's metadata schema. S:U (Unchanged scope) and C:L/I:L/A:L indicate the blast radius is limited to low-level confidentiality, integrity, and availability impact within the system boundary. EPSS at 0.04% (13th percentile) corroborates that active, widespread exploitation is not observed. The vulnerability is not listed in CISA KEV. The primary real-world risk is an insider threat or a compromised CMA administrator account pivoting to tamper with compliance posture reporting in domains they should not control - a governance and audit integrity concern rather than a remote compromise risk. No conflicting signals between CVSS vector and description are noted.

An authenticated Check Point CMA administrator with legitimate read-write access to Domain A - such as an insider or an attacker who has compromised a domain-scoped admin account - accesses the Compliance Best Practices metadata interface and submits a crafted SQL injection payload within a metadata field. The injected SQL escapes the Domain A query context, crosses the domain isolation boundary in the backend database, and modifies Compliance Best Practices metadata records belonging to Domain B, where the administrator holds no assigned permissions. This could be used to falsify compliance status, suppress Best Practice violations, or corrupt audit trail data for a domain outside the attacker's authorized scope.