CVE-2026-120490
Administrator with policy and NAT permissions can bypass Sync network protection on Scalable Platforms
CVSS Score
3.8
EPSS Score
0.0%
EPSS Percentile
0th
On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface, bypassing the built-in Sync protection. This could allow the administrator to execute operating system commands and write files on the Gateway with superuser privileges.
| CWE | CWE-696 |
| Vendor | checkpoint |
| Product | scalable platforms (elasticxl, maestro, chassis) |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for checkpoint scalable platforms (elasticxl, maestro, chassis)
Be the first to know when new low vulnerabilities affecting checkpoint scalable platforms (elasticxl, maestro, chassis) are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
checkpoint / Scalable Platforms (ElasticXL, Maestro, Chassis)
R82 with Jumbo Hotfix Take 130 or below R81.20 with Jumbo Hotfix Take 173 or below