{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-120490","assignerOrgId":"897c38be-0345-43cd-b6cf-fe179e0c4f45","state":"PUBLISHED","assignerShortName":"checkpoint","dateReserved":"2026-11-02T14:05:57.337Z","datePublished":"2026-11-12T14:01:48.152Z","dateUpdated":"2026-11-12T14:01:48.152Z"},"containers":{"cna":{"affected":[{"product":"Scalable Platforms (ElasticXL, Maestro, Chassis)","vendor":"checkpoint","versions":[{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]}],"title":"Administrator with policy and NAT permissions can bypass Sync network protection on Scalable Platforms","descriptions":[{"lang":"en","value":"On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface, bypassing the built-in Sync protection. This could allow the administrator to execute operating system commands and write files on the Gateway with superuser privileges."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-696","description":"CWE-696: Incorrect Behavior Order.","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"897c38be-0345-43cd-b6cf-fe179e0c4f45","shortName":"checkpoint","dateUpdated":"2026-11-12T14:01:48.152Z"},"references":[{"url":"https://support.checkpoint.com/results/sk/sk1000364"}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":3.8,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"}}],"x_generator":{"engine":"cvelib 1.8.0"}}}}