CVE-2026-48134 SQL injection issue in UserCheck Portal when DLP Software Blade is active
Attackers can manipulate stored DLP incident data via SQL injection in the UserCheck Portal when the DLP Software Blade is active.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48134?
CVE-2026-48134 is a medium-severity SQL injection vulnerability in checkpoint Quantum Security Gateway, published on 26 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
When the DLP is active, the UserCheck Web Portal contains an input-handling issue in the UserChoice flow. Under specific conditions, an attacker who can access the UserCheck Ask page could attempt to manipulate the Security Gateway's stored DLP/UserCheck incident information. This could lead to disruptions such as loss of stored incident entries, incorrect handling of pending approvals, or resource impact if the issue is abused repeatedly. Exposure is reduced if the UserCheck Portal is not accessible from untrusted networks.
Weakness: CWE-89
Which versions are affected by CVE-2026-48134?
How do I fix CVE-2026-48134?
No fix has been published for CVE-2026-48134 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-48134 being exploited?
There is no known exploitation of CVE-2026-48134 in the wild and no public exploit code.
Sources
Also known as GHSA-22vq-6hm4-vrwc.