Authenticated Command Execution in Check Point Gaia Portal

Executive Summary

CVE-2026-62145 is a local privilege escalation vulnerability in Check Point Gaia Portal. It allows an authenticated attacker with read-only access to execute commands as the root user, bypassing normal restrictions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Check Point Gaia Portal is running an affected version (R77.30, R80, R80.10, R80.20, R80.30, R81, R81.10, R81.20, R82, R82.10). Verify if unauthorized root-level commands are being executed by monitoring system logs for unexpected privilege escalations.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control over the affected system, install malware, steal data, or disrupt operations. Even with limited access, they could escalate privileges to root and perform unauthorized actions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Non-compliance may result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict admin access to Gaia OS via Gateway and Management Hardening Best Practices. Limit access to trusted hosts or subnets in Gaia Portal under System Management > Host Access > Allowed Hosts. Enable Multi-Factor Authentication (MFA) for administrators under User Management > Authentication. Apply specific Jumbo Hotfix Accumulators: Take 36 for R82.10, Take 118 for R82, and Take 158 for R81.20.

Useful 0 Not Useful 0