CVE-2026-62145

Local Privilege Escalation in Gaia Portal

No known exploitation. EPSS puts it in the 32nd percentile. No fix published yet.

CVSS 3.17.5High EPSS percentile32nd0.4% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-07-22Updated 2026-07-24Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

checkpoint Quantum Security GatewayAffected: R82.10 with Jumbo Hotfix Take 36 or belowUpgrade to: not statedAffected: R82 with Jumbo Hotfix Take 118 or belowUpgrade to: not statedAffected: R81.20 with Jumbo Hotfix Take 158 or belowUpgrade to: not statedAffected: R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30Upgrade to: not statedStated by: CVE record
checkpoint Quantum Security ManagementAffected: R82.10 with Jumbo Hotfix Take 36 or belowUpgrade to: not statedAffected: R82 with Jumbo Hotfix Take 118 or belowUpgrade to: not statedAffected: R81.20 with Jumbo Hotfix Take 158 or belowUpgrade to: not statedAffected: R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30Upgrade to: not statedStated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your Check Point “Gaia Portal” is reachable over the network (especially from any untrusted networks) and whether any “read-only” Gaia Portal users exist.
Confirm your current software versions for “quantum security gateway” and “quantum security management” against the latest vendor security advisories for CVE-2026-62145.
If an update is not yet available, immediately restrict network reachability to the Gaia Portal / management interfaces (allow only trusted source IPs, and do not leave Trusted Clients unrestricted).
Remove or reduce read-only Gaia Portal access: eliminate unused accounts and ensure only required staff have Gaia Portal access.
Create a short-term monitoring plan for post-login behavior and command execution attempts from Gaia Portal accounts, and review logs for suspicious administrative actions.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

Coverage timeline

3 publishers

Exploitation reported in the wild
as reported · Jul 27, 2026·Хакер (xakep.ru) summary
Vendor patch released
as reported · Jul 23, 2026·The Hacker News summary

Sourced from public security reporting — each date is when it was published, not when it happened. 3 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.

In plain language

Written by AI from the record

CVE-2026-62145 lets an attacker who already has low-level access to Check Point Gaia Portal run commands as the system’s super-user (root); this has been reported as exploited, so you should treat it as urgent if your gateway/management services are reachable from the network.

CVE-2026-62145 is a local privilege escalation in Check Point Gaia Portal where an authenticated user with read-only Gaia Portal access can execute arbitrary commands as root (network-reachable; no user interaction).

If you're affected

Full system takeover
Security policies can be changed
Service disruption
Potential ransomware enablement

What is it

Think of Gaia Portal as the “control room” for your security products. This flaw lets someone who only has basic “read-only” access to that control room take over the whole system and run powerful commands as the top-level administrator.

In practical terms, it’s like giving a staff member a clipboard (read-only view) and having them find a way to turn it into the keys that unlock the entire building’s security controls.

Who is affected

This matters if you run Check Point “quantum security gateway” or “quantum security management” and those systems expose Gaia Portal to the network.

If an attacker can reach the management interface and obtain read-only Gaia Portal access, they can escalate to root and run arbitrary commands.

This is only a risk when the attacker can reach the relevant network endpoint(s) and gain that low-level Gaia Portal access (or otherwise get into the required access state).

How urgent is it

Red: exploitation has been reported, and the vulnerability can lead directly to root-level command execution. Attackers only need low-level Gaia Portal access (read-only) and network reachability, with no user action required.

Even though a public patch is not yet provided in the available information, you should prioritize containment (restrict reachability and remove/limit Gaia Portal accounts) immediately.

What to do — in detail

Confirm exposure (fast)

Identify the management/gateway endpoints that provide “Gaia Portal” access in your environment.
From your network edge perspective, check whether those endpoints are reachable from untrusted networks (internet, partner networks, Wi‑Fi guest networks, etc.).
Inventory Gaia Portal accounts: confirm which accounts are “read-only,” where they’re used, and whether any are shared.

Confirm software/version status

For “quantum security gateway” and “quantum security management,” look up the installed software versions.
Check the latest vendor security advisory/patch notes for CVE-2026-62145 to see whether a fixed version exists for your exact branch. (In the available findings, no fixed version information is provided yet.)

Immediate containment while waiting for a fix

Restrict network access: allow only required source IP ranges to reach Gaia Portal/management interfaces.
Do not leave “Trusted Clients” unrestricted; ensure only explicitly trusted systems/users/networks can reach management.
Remove unused Gaia Portal accounts and reduce the number of read-only accounts to the minimum required.

Validate mitigation effectiveness

After restricting access, test from an external/untrusted network that Gaia Portal is no longer reachable.
Ensure only the intended admin networks can access it.

Monitoring and response

Review logs around Gaia Portal usage for: unexpected logins from unusual IPs, repeated access attempts, and any unusual administrative actions.
If you find suspicious activity, treat it as potential full compromise because the described impact includes root command execution.

CISA due date: not specified in the provided findings.
What to monitor: Gaia Portal login activity, access from unexpected IP ranges, and any subsequent administrative changes on the management side.

Technical context

Severity is high in impact because the weakness enables execution of arbitrary commands as root (CWE-269: Improper Privilege Management), not just a data leak.

Attack mechanism (from the findings): network-reachable access to Gaia Portal with low authentication requirements; an authenticated attacker with read-only Gaia Portal privileges can escalate to root and execute commands. User interaction is not required.

Exploitation status: exploitation has been reported (press/real-world reporting indicates active exploitation activity in the ecosystem). Although this specific CVE is not listed in CISA KEV in the provided findings, treat it as actively dangerous.

Patch status: no fix/patch information is available in the provided findings, so mitigation relies on reducing exposure (network reachability and least privilege) until vendor guidance/updates are identified.

EPSS is present as a prediction in the findings, but exploitation reporting takes precedence over predicted likelihood.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS32nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.4% chance of exploitation activity in the next 30 days, which ranks it in the 32nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 3 days, from the signal feeds we watch.

2026-07-25OpenVAS check added
2026-07-24Record updated
2026-07-22Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

checkpointcommercial · ILaka check point firewall-1, checkpoint firewall
- Quantum Security GatewaySecurity Products
- Quantum Security ManagementSecurity Products

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable