ctipilot.ch

Check Point Gaia Portal read-only to root command execution

cve · CVE-2026-62145

Coverage timeline
1
first 2026-07-25 → last 2026-07-25
Peak priority
high
1 high
Sources cited
4
3 hosts
Sections touched
1
updates
Co-occurring entities
1
see Related entities below
ATT&CK techniques
2
pinned v19.1 · see below

Hunting pivots

ATT&CK techniques
T1068T1190
Affected products
Check Point Gaia PortalCheck Point Multi-Domain Security Management ServerCheck Point Security Management Server
Tags
auth-bypasspatch-availablepriv-escrcevulnerabilities

ATT&CK techniques

2 techniques observed across 1 entry — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-25/check-point-mgmt-cve-2026-62144-62145-siblings · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-07-25/check-point-mgmt-cve-2026-62144-62145-siblings · ATT&CK page ↗

Story timeline

  1. 2026-07-25Check Point Security Management: two more CVEs in the actively-exploited SmartConsole bundle — unauth management RCE (CVE-2026-62144) and Gaia Portal root escalation (CVE-2026-62145)
    updatesSame actively-attacked Check Point Management surface carries an unauthenticated command-execution flaw

Where this entity is cited

  • updates1

Source distribution

  • support.checkpoint.com2 (50%)
  • advisories.ncsc.nl1 (25%)
  • cert.ssi.gouv.fr1 (25%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

External references

NVD · cve.org · CISA KEV

All cited sources (4)

Entries about Check Point Gaia Portal read-only to root command execution (1)

2026-07-25 · view entry permalink →

HIGHCVE-2026-62144 +1updateNATOA2

Check Point Security Management: two more CVEs in the actively-exploited SmartConsole bundle — unauth management RCE (CVE-2026-62144) and Gaia Portal root escalation (CVE-2026-62145)

UPDATE · originally covered CVE-2026-16232 — Check Point SmartConsole: authentication bypass to full admin, exploited in the wild (CVSS 9.1) (2026-07-23)

The prior entry covered the actively-exploited Check Point SmartConsole authentication bypass CVE-2026-16232. NCSC-NL advisory NCSC-2026-0264 (2026-07-24) and CERT-FR CERTFR-2026-AVI-0912 (2026-07-23) now confirm that the same Check Point patch release carried two further CVEs on the same attack surface that had not been surfaced individually (NCSC-NL, 2026-07-24; CERT-FR, 2026-07-23).

CVE-2026-62144 (NCSC-NL CVSS v4 10.0; Check Point publishes only a qualitative "High" severity, no numeric CVSS 3.1 score) lets an unauthenticated network attacker "run any command on the Management including run-script and exec-command on Security Gateway" — i.e. arbitrary command execution against a Security Management or Multi-Domain Security Management server, and by extension against every gateway that server manages, whenever the Management is reachable without firewall protection or with an unrestricted Trusted Clients (GUI clients) list (Check Point PSIRT sk185152, 2026-07-22). CVE-2026-62145 (Check Point CNA CVSS 3.1 7.5; NCSC-NL CVSS v4 9.4) is a Gaia Portal escalation in which "an authenticated attacker with read-only access [can] run commands as root," affecting Security Gateways and Security Management alike (Spark Gateways excepted) (Check Point PSIRT sk185153, 2026-07-22). Both span the same version range as the exploited CVE-2026-16232 (R77.30 through R81.20/R82/R82.10 prior to fix) and both close with the same Jumbo Hotfix Accumulator line.

The material delta for defenders is exposure, not new exploitation: Check Point reports only CVE-2026-16232 seen abused, against a small number of customers who left the Management internet-exposed with a permissive Trusted Clients configuration (NCSC-NL, 2026-07-24).

An unauthenticated attacker can run any command on the Management including run-script and exec-command on Security Gateway.

Check Point PSIRT (sk185152) 2026-07-22

A vulnerability in Gaia Portal allows an authenticated attacker with read-only access to run commands as root.

Check Point PSIRT (sk185153) 2026-07-22
vulnerability25 Jul 04:38Zmulti-sourceOpen finding ↗
Sources: Check Point PSIRT (sk185152) · Check Point PSIRT (sk185153) · NCSC-NL · CERT-FR / ANSSI