SB2026111318 - Multiple vulnerabilities in Check Point Gaia
Published: November 13, 2026 Updated: November 13, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Incorrect authorization (CVE-ID: CVE-2026-107484)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to escalate privileges, execute commands with elevated privileges, and gain full administrative control of the Gaia system.
The vulnerability exists due to improper input validation and authorization checks in Gaia Portal backend handlers when processing requests for privileged operations. A remote user can submit requests using a non-administrative account to perform operations that should be restricted to administrators.
2) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-123039) Exploited
CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges and execute arbitrary commands as root.
The vulnerability exists due to world-writable permissions (0777) and missing authentication of connecting processes in the Gaia Dynamic CLI control socket /tmp/dynamic_socket when handling local IPC requests. A local user can use existing local code execution to write a single request containing arbitrary commands to the socket, which the dynamic_server process executes as root.
3) Incorrect authorization (CVE-ID: CVE-2026-120490)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote privileged user to execute operating system commands and write files on the Gateway with superuser privileges.
The vulnerability exists due to improper access control in the Scalable Platform Gateway's Sync traffic protection when processing traffic with a translated destination. A remote privileged user can use permissions to edit and install the Access Control Policy and NAT rules to create a NAT rule that redirects traffic to the Sync interface, bypassing its protection to execute operating system commands and write files with superuser privileges.
Remediation
Install update from vendor's website.