CVE-2026-48134: SQL injection issue in UserCheck Portal when DLP Software Blade is active
When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access the UserCheck Ask page could attempt to manipulate the Security Gateway's stored DLP/UserCheck incident information. This could lead to disruptions such as loss of stored incident entries, incorrect handling of pending approvals, or resource impact if the issue is abused repeatedly. Exposure is reduced if the UserCheck Portal is not accessible from untrusted networks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48134?
CVE-2026-48134 has a severity score of 7.6, categorized as high.
How do I fix CVE-2026-48134?
To address CVE-2026-48134, ensure that your Check Point UserCheck Web Portal and Security Gateway are updated to the latest version that contains the security patch.
What systems are affected by CVE-2026-48134?
CVE-2026-48134 affects Check Point UserCheck Web Portal and Check Point Security Gateway when the DLP Software Blade is active.
What type of vulnerability is CVE-2026-48134?
CVE-2026-48134 is an SQL injection vulnerability that allows potential manipulation of DLP/UserCheck incident information.
Can CVE-2026-48134 lead to data exposure?
Yes, if exploited, CVE-2026-48134 can lead to unauthorized access and manipulation of sensitive incident information.