EUVD-2026-47702
GHSA-jh99-mm75-xrmv
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires an existing read-only portal account (PR:L) reachable over the network (AV:N); vendor-rated non-trivial technique (AC:H) yielding full root control (C:H/I:H/A:H) within the same host (S:U).
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.
AnalysisAI
Privilege escalation in Check Point Gaia Portal allows an authenticated user holding only read-only administrative privileges to execute arbitrary commands as root, giving full compromise of the affected Quantum Security Gateway or Security Management appliance. The flaw (CWE-269, improper privilege management) is vendor-reported via advisory sk185153 and carries a CVSS 3.1 base score of 7.5 with high attack complexity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must already possess valid authenticated credentials for a Gaia Portal account with read-only privileges (PR:L) and network reachability to the Gaia Portal web interface (AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a network-reachable interface (AV:N) requiring some existing low privilege (PR:L, the read-only Gaia Portal account) and high attack complexity (AC:H), with total confidentiality, integrity, and availability impact once achieved (C:H/I:H/A:H, root access). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An MSSP analyst, contractor, or internal auditor who has been given a read-only Gaia Portal login authenticates to the management interface and abuses the privilege-management flaw to break out into the underlying Gaia OS shell, executing commands as root. From there they can alter firewall policy, exfiltrate configuration and credentials, or disable the gateway. … |
| Remediation | Apply the fix and guidance published in Check Point advisory sk185153 (https://support.checkpoint.com/results/sk/sk185153); patch available per vendor advisory, but an exact fixed version/Jumbo Hotfix Take was not provided in the input data and must be read directly from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all read-only administrator accounts in your Check Point deployments and document their current privileges; disable or severely restrict any unnecessary read-only admin accounts and implement dual-approval requirements for all administrative access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Checkpoint
View allbackend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef
Arbitrary code execution via torch-checkpoint-shrink.py script in ml-engineering project allows remote attackers to exec
Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without us
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today