Is CVE-2026-48133 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-48133 being exploited in the wild.

How severe is CVE-2026-48133?

High severity, with a CVSS score of 7.5, published 26 May 2026.

Which products and versions are affected?

Check Point Security Gateway (Identity Awareness blade).

Is there a fix for CVE-2026-48133?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-48133 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-48133?

Check whether you run Check Point Security Gateway Identity Awareness. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-48133: Check Point Security Gateway LFI in Identity Awareness blade

CVE-2026-48133 · Severity: high · CVSS 7.5 · Published 2026-05-26

Check Point Security Gateways using the Identity Awareness feature are vulnerable to a security flaw that allows unauthorized access to internal system files. This component is typically used to identify users and control network access via a web login page. An attacker could exploit this to steal sensitive configuration data or system information without needing any login credentials, potentially compromising the security of the network gateway.

Vendors: Check Point.

Quick answers

Is CVE-2026-48133 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-48133 being exploited in the wild.
How severe is CVE-2026-48133?: High severity, with a CVSS score of 7.5, published 26 May 2026.
Which products and versions are affected?: Check Point Security Gateway (Identity Awareness blade).
Is there a fix for CVE-2026-48133?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-48133 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48133?: Check whether you run Check Point Security Gateway Identity Awareness. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Local File Inclusion (LFI) vulnerability exists in the Check Point Identity Awareness blade when Browser-Based Authentication (Captive Portal) is enabled. The vulnerability is rooted in improper control of filenames used in PHP 'include' or 'require' statements (CWE-98). A remote, unauthenticated attacker can exploit this by sending a specially crafted network request to the gateway's web interface. Successful exploitation allows the attacker to read arbitrary internal files on the Security Gateway, which may contain sensitive configuration data or system credentials. Check Point has released a security advisory (sk184993) to address this issue.

Affected products

Check Point Security Gateway (Identity Awareness blade)

Timeline

2026-05-26: advisory: Check Point published security advisory sk184993
2026-05-26: disclosed: CVE-2026-48133 published to the NVD

References

https://support.checkpoint.com/results/sk/sk184993

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.