EUVD-2026-47702
GHSA-jh99-mm75-xrmv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Gaia Portal as read-only user
-
DeliveryReach vulnerable portal function
-
ExploitAbuse improper privilege management
-
ExecutionExecute commands as root
-
ImpactFull appliance compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The attacker must already possess valid authenticated credentials for a Gaia Portal account with read-only privileges (PR:L) and network reachability to the Gaia Portal web interface (AV:N). No end-user interaction is required (UI:N). Exploitation is limited by the need for that pre-existing low-privileged account, by high attack complexity (AC:H) implying specific conditions or a non-trivial technique must be met, and by the exposure of the management interface - deployments that keep the Gaia Portal off general networks and grant read-only accounts sparingly are substantially harder to attack. |
| Impact | The CVSS vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a network-reachable interface (AV:N) requiring some existing low privilege (PR:L, the read-only Gaia Portal account) and high attack complexity (AC:H), with total confidentiality, integrity, and availability impact once achieved (C:H/I:H/A:H, root access). This is genuinely serious because it collapses the distinction between a limited auditor-type account and full device root - but several signals temper urgency: exploitation is gated behind valid authentication (a read-only account is still an account), attack complexity is rated High, no public exploit code is identified, and the CVE is not in CISA KEV. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The practical priority is high for organizations that grant read-only Gaia Portal access broadly (e.g., to auditors, NOC staff, or MSSP tenants), and moderate where portal access is tightly restricted to trusted senior administrators. |
| Exploit ScenarioDerived | An MSSP analyst, contractor, or internal auditor who has been given a read-only Gaia Portal login authenticates to the management interface and abuses the privilege-management flaw to break out into the underlying Gaia OS shell, executing commands as root. From there they can alter firewall policy, exfiltrate configuration and credentials, or disable the gateway. The high attack complexity (AC:H) suggests a non-trivial sequence is required, and no public proof-of-concept is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Privilege escalation in Check Point Gaia Portal allows an authenticated user holding only read-only administrative privileges to execute arbitrary commands as root, giving full compromise of the affected Quantum Security Gateway or Security Management appliance. The flaw (CWE-269, improper privilege management) is vendor-reported via advisory sk185153 and carries a CVSS 3.1 base score of 7.5 with high attack complexity. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Apply the fix and guidance published in Check Point advisory sk185153 (https://support.checkpoint.com/results/sk/sk185153); patch available per vendor advisory, but an exact fixed version/Jumbo Hotfix Take was not provided in the input data and must be read directly from that advisory. As compensating controls until patched, restrict who is granted read-only Gaia Portal accounts and audit existing role assignments, since the exploit requires such an account; limit network reachability of the Gaia Portal management interface to a dedicated management network or jump host and block it from general user/internet segments (trade-off: administrators must connect via the management path); and enable and monitor logging for unexpected shell/command execution or privilege transitions originating from read-only accounts. These controls reduce exposure but do not eliminate the flaw, so patching per sk185153 remains the primary action.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Gaia is Check Point's unified security operating system, and the Gaia Portal is its web-based management interface used to administer Quantum Security Gateway (firewall/enforcement) and Quantum Security Management (centralized policy management) appliances. The root cause is CWE-269 (Improper Privilege Management): the portal's role-based access control fails to properly confine a read-only administrator, allowing that low-privileged web role to cross the boundary into the underlying Gaia OS shell and run commands as root. The affected CPEs are cpe:2.3:a:checkpoint:quantum_security_gateway and cpe:2.3:a:checkpoint:quantum_security_management, indicating both the enforcement and management planes of the Quantum product line are in scope.
Know when Checkpoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires an existing read-only portal account (PR:L) reachable over the network (AV:N); vendor-rated non-trivial technique (AC:H) yielding full root control (C:H/I:H/A:H) within the same host (S:U).
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
DescriptionCVE.org
A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.
Executive ViewAI
A privilege escalation vulnerability in Check Point Gaia Portal affects Quantum Security Gateways and Security Management appliances, enabling authenticated read-only administrators to gain root access and fully compromise these appliances. This creates a direct threat to perimeter defense integrity and control-plane security across your infrastructure.
No vendor-released patch identified at time of analysis. Implement the following interim controls: restrict network access to management interfaces via firewall rules and VPN-only access, enforce multi-factor authentication for all administrative access, monitor audit logs for unauthorized privilege escalation attempts, implement command-line auditing and session recording for all administrative sessions, restrict the ability to execute commands through non-standard channels, and minimize the number of read-only administrators with regular role permission reviews.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Exploit-DB