Vulnerability · Published May 26, 2026 · Assigned by checkpoint
CVE-2026-48136Authenticated Administrator Role-Based Access Control Bypass in Compliance
Medium 4.1
In plain English
A medium-severity SQL injection in Quantum Security Management from checkpoint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities).
Severity (CVSS 3.1)4.1Medium
Exploit odds (30 days)3.7%top 10.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can modify stored metadata associated with Compliance Best Practices in another Management Domain, where the administrator has no access permissions, bypassing Role-Based Access Control (RBAC).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| checkpoint | Quantum Security Management | R82.10 with Jumbo Hotfix Take 6 or belowR82 with Jumbo Hotfix Take 91 or belowR81.20 with Jumbo Hotfix Take 127 or belowAll releases from R81.10 and below |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L