CVE-2026-120490
Received Received - Intake

Command Injection in Scalable Platforms Gateway

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: Check Point Software Technologies Ltd.

Description
On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface, bypassing the built-in Sync protection. This could allow the administrator to execute operating system commands and write files on the Gateway with superuser privileges.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-120490
EUVD
EUVD-2026-124480

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
checkpoint gateway *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-696 The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an administrator with permissions to edit Access Control Policy and NAT rules on Scalable Platforms to create a NAT rule that redirects traffic to the Gateway's Sync interface. This bypasses built-in Sync protection, enabling the administrator to execute operating system commands and write files on the Gateway with superuser privileges.

Impact Analysis

An attacker with administrative access could exploit this to gain full control over the Gateway, execute arbitrary commands, and modify system files. This could lead to unauthorized access, data breaches, or complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements for GDPR (data protection), HIPAA (health information security), and other regulations that mandate strict access controls and data integrity.

Mitigation Strategies

Restrict administrator permissions to prevent unauthorized creation of NAT rules that redirect traffic to the Gateway's Sync interface. Review existing NAT and Access Control Policies for suspicious rules.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120490. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...