> Source: [sk1000364](https://support.checkpoint.com/results/sk/sk1000364)

# sk1000364 - CVE-2026-120490 - Administrator with policy and NAT permissions can bypass Sync network protection on Scalable Platforms

| Property | Value |
|----------|-------|
| Solution ID | sk1000364 |
| Date Created | 2026-11-08 |
| Last Modified | 2026-11-12 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R82, R81.20 |

## Symptoms

- * An administrator who can edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Scalable Platform Gateway's Sync interface. The Gateway's built-in protection for Sync traffic does not apply when the destination is translated. As a result, the administrator can execute operating system commands and write files on the Gateway with superuser privileges.
* This issue received the ID [CVE-2026-120490](https://www.cve.org/CVERecord?id=CVE-2026-120490) and a CVSS score of 3.8.
* **Affected Products:**Maestro Orchestrator, Firewalls in Maestro Cluster, ElasticXL Clusters
* **Non-Affected products:** Check Point Force Firewall in ClusterXL or VRPP configuration, Check Point Spark Firewalls
* **Affected Versions:**R81.20, R82
* **Non-Affected Versions:** R82.10, R82.20

<br />

<br />

### How to identify this attack

<br />

1. In SmartConsole, verify that the rulebase does not contain NAT translation rules involving the Sync network (192.0.2.0/24).  

2. Verify the Sync network is secured.  
   **For Maestro** , when you connect the external synchronization ports of Orchestrators on different Maestro Sites through switches (not directly to each other), make sure your Layer 2 network between Orchestrators is secure.   
   (Refer to the [Maestro Getting Started Guide](https://sc1.checkpoint.com/documents/Appliances/GSG_Maestro/EN/Default.htm) \> sections "Dual Site with four Switches between MHO-175, MHO-170, MHO-140" and "Dual Site with two Switches between MHO-175, MHO-170, MHO-140".)  
   Also see [sk168092 - Maestro Dual Site configuration with a direct connection through L2 switches](https://support.checkpoint.com/results/sk/sk168092)  

### Mitigation

1. Review the NAT rulebase and remove any NAT rules that translate traffic to the Sync network (192.0.2.0/24).
2. Install the updated Security Policy to apply the changes.

## Solution

This problem was fixed. The fix is included in:

* [Check Point R82.20](https://support.checkpoint.com/results/sk/sk185039)
* [Check Point R82.10](https://support.checkpoint.com/results/sk/sk183506)
* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 132
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 174

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content