{"id":"CVE-2026-120490","aliases":[],"cve":{"records":[{"id":"CVE-2026-120490","source":"checkpoint","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-02T14:05:57.337Z","published":"2026-11-12T14:01:48.152Z","modified":"2026-11-12T14:01:48.152Z"}],"publishers":[{"name":"checkpoint","role":"CNA","organizationId":"897c38be-0345-43cd-b6cf-fe179e0c4f45","modified":"2026-11-12T14:01:48.152Z"}],"references":[{"url":"https://support.checkpoint.com/results/sk/sk1000364","tags":[],"source":"checkpoint"}],"weaknesses":[{"id":"CWE-696","description":"CWE-696: Incorrect Behavior Order.","source":"checkpoint"}],"applicability":[],"prioritization":[]},"title":"Administrator with policy and NAT permissions can bypass Sync network protection on Scalable Platforms","titleSource":"checkpoint","descriptionSource":"checkpoint","description":"On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface, bypassing the built-in Sync protection. This could allow the administrator to execute operating system commands and write files on the Gateway with superuser privileges.","score":3.8,"severity":"low","published":"2026-11-12T14:01:48.152Z","modified":"2026-11-12T14:01:48.152Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"checkpoint","name":"Scalable Platforms (ElasticXL, Maestro, Chassis)","platforms":[],"versions":[{"version":"R82 with Jumbo Hotfix Take 130 or below","status":"affected"},{"version":"R81.20 with Jumbo Hotfix Take 173 or below","status":"affected"}],"cpes":[],"source":"checkpoint","url":"https://www.cve.org/CVERecord?id=CVE-2026-120490"}],"remediation":[],"references":["https://support.checkpoint.com/results/sk/sk1000364"],"sources":[{"name":"CVE","id":"CVE-2026-120490","modified":"2026-11-12T14:01:48.152Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-120490"}],"assessments":[{"source":"checkpoint","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","score":3.8}],"sourceAffected":[],"observedAt":"2026-11-12T21:23:47.904Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-13T02:25:31.501Z","attemptedAt":"2026-11-13T02:25:31.501Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T02:20:39.319Z","attemptedAt":"2026-11-13T02:20:39.319Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T02:20:40.165Z","attemptedAt":"2026-11-13T02:20:40.165Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-13T02:25:32.171Z","attemptedAt":"2026-11-13T02:25:32.171Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-hm5p-5q79-9h74","url":"https://github.com/advisories/GHSA-hm5p-5q79-9h74","modified":"2026-11-12T15:32:01Z","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-11-13T02:20:39.319Z"},{"source":"ENISA EUVD","id":"EUVD-2026-124480","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-124480","modified":"Nov 12, 2026, 2:01:48 PM","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-11-13T02:20:40.165Z"},{"source":"NVD","id":"CVE-2026-120490","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120490","modified":"2026-11-12T20:04:52.377","score":3.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","checkedAt":"2026-11-13T02:25:31.501Z"}],"aiSummary":{"text":"On Scalable Platforms, an administrator with policy and NAT permissions can bypass Sync network protection by creating a NAT rule. This could allow execution of operating system commands and file writes with superuser privileges. Affected versions include R82 with Jumbo Hotfix Take 130 or below and R81.20 with Jumbo Hotfix Take 173 or below.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T04:11:11.187Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-120490"}]}}