This vulnerability (CVE-2026-48136) in Check Point Quantum Security Management involves improper neutralization of special elements used in SQL commands (CWE-89), leading to an SQL Injection scenario. Specifically, when Compliance is enabled on Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain can alter metadata associated with Compliance Best Practices in another Management Domain where they lack permissions. This bypasses the Role-Based Access Control (RBAC) model, potentially allowing unauthorized data modification across domains. The affected versions include R81.10 and below with various Jumbo Hotfix Take levels up to R82.10 with Jumbo Hotfix Take 6. The CVSS 3.1 score is 4.1, indicating medium severity, with attack vector network, high attack complexity, requiring high privileges, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability.

An authenticated administrator with read-write access in one Management Domain can bypass RBAC restrictions to modify Compliance Best Practices metadata in other Management Domains where they have no permissions. This could lead to unauthorized changes in compliance configurations across domains, potentially affecting security policy enforcement or auditing accuracy. The impact on confidentiality, integrity, and availability is rated low according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor Check Point advisories for updates. Until a patch is available, limit administrative access strictly and review permissions to reduce risk. No vendor advisory indicates that the issue is already mitigated or requires no action.