Answer in brief
CVE-2026-120490 records a Low severity (CVSS 3.8) vulnerability in Administrator with policy and NAT permissions can bypass Sync network protection on Scalable Platforms. The current sources do not mark it as known exploited. The current feed maps checkpoint/Scalable Platforms (ElasticXL, Maestro, Chassis) (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 3.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps checkpoint/Scalable Platforms (ElasticXL, Maestro, Chassis) (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| checkpoint/Scalable Platforms (ElasticXL, Maestro, Chassis)generic | R82 with Jumbo Hotfix Take 130 or below || R81.20 with Jumbo Hotfix Take 173 or below | Not reported |
Published upstream
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 12, 2026
On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface, bypassing the built-in Sync protection. This could allow the administrator to execute operating system commands and write files on the Gateway with superuser privileges.
Quoted source text, attributed separately from HOL analysis.