{"affected":[{"product":"Scalable Platforms (ElasticXL, Maestro, Chassis)","source":"CNA: checkpoint","vendor":"checkpoint","versions":[{"status":"affected","version":"R82 with Jumbo Hotfix Take 130 or below"},{"status":"affected","version":"R81.20 with Jumbo Hotfix Take 173 or below"}]}],"cveId":"CVE-2026-120490","cwes":["CWE-696"],"description":"On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface, bypassing the built-in Sync protection. This could allow the administrator to execute operating system commands and write files on the Gateway with superuser privileges.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":3.8,"severity":"low","source":"CNA: checkpoint","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794492108152,"publishedAt":1794492108152,"references":[{"source":"CNA: checkpoint","tags":[],"url":"https://support.checkpoint.com/results/sk/sk1000364"}],"remediation":[],"revision":"9f7861437e9d30dd399ff54bd91321fcb72020c436a8c0c49095557b4ef7f296","sources":[{"modifiedAt":1794492108152,"name":"CNA: checkpoint","retrievedAt":1794496245680,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120490"}],"ssvc":null,"status":"published","title":"Administrator with policy and NAT permissions can bypass Sync network protection on Scalable Platforms","updatedAt":1794496245680}