> Source: [sk1000291](https://support.checkpoint.com/results/sk/sk1000291)

# sk1000291 - CVE-2026-107484 - Input Validation Vulnerability in Gaia Portal backend handlers allows privilege escalation by an authenticated user

| Property | Value |
|----------|-------|
| Solution ID | sk1000291 |
| Date Created | 2026-10-19 |
| Last Modified | 2026-11-12 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, Multi-Domain Security Management Server |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * An input and authorization validation vulnerability in Gaia Portal backend handlers could allow an authenticated, non-administrative user to perform privileged operations that should be restricted to administrators. If exploited, this could let the attacker run commands with elevated privileges and gain full administrative control of the Gaia system.
* This issue received the ID [CVE-2026-107484](https://www.cve.org/CVERecord?id=CVE-2026-107484) and a CVSS score of 7.3.
* **Affected Products:**
  * Check Point Force Firewalls
  * Check Point Management and Log Servers
  * Multi-Domain Security Management and Multi-Domain Log Server
* **Not Affected Products:**Smart-1 Cloud (fix is already applied), Check Point Spark Firewall
* **Affected Versions:**
  * R82.10, R82, R81.20
  * R81.10, R81, R80.40, R80.30, R80.20, R80.10, R80 (all EoS)
* **Not Affected Versions:** R82.20

<br />

<br />

Mitigation
----------

Restrict hosts or networks that are allowed to connect to your Gaia Portal or Gaia
Clish.

In **Gaia Portal:**

1. In the navigation tree, click **System Management** \> **Host Access**.
2. Click **Add** . The **Add a New Allowed Client** window opens.
3. Select one of these options:
   * **Any host** - All remote hosts can access the Gaia Portal or Gaia Clish.
   * **Host** - Enter the IPv4 address of one host.
   * **Network** - Enter the IPv4 address of a network and subnet mask.
4. Click **OK**.

Note: On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

<br />

In **Gaia Clish:**

To add an allowed client, run:

```
add allowed-client
       host
          any-host
          ipv4-address 
       network ipv4-address mask-length <1-31>  
```

For more information, see the [Gaia Administration Guide](https://sc1.checkpoint.com/documents/R82.20/WebAdminGuides/EN/CP_R82.20_Gaia_AdminGuide/Default.htm) \> Host Access section.

Note: On Scalable Platforms, you must run the applicable commands in Gaia gClish of the applicable Security Group.

## Solution

This problem was fixed. The fix is included in:

* [Check Point R82.20](https://support.checkpoint.com/results/sk/sk185039)
* [Jumbo Hotfix Accumulator for R82.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) starting from Take 52
* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 132
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 174

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content