EUVD-2026-47701
GHSA-qg2m-c9gf-4qvp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network auth-bypass yields admin command execution (PR:N, C:H/I:H); S:C because control extends from the Management Server to separate managed gateways; A:N as no availability impact is described.
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
Lifecycle Timeline
4DescriptionCVE.org
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security Gateways. Exploitation requires network access to the Management Server without firewall protection or a configuration that does not restrict Trusted Clients.
AnalysisAI
Authentication bypass in Check Point Quantum Security Management and Multi-Domain Security Management lets an unauthenticated remote attacker (CVSS:3.1 PR:N) run administrative commands directly on the Management Server, and potentially pivot to command execution on the managed Security Gateways it controls. It affects a broad range of releases (R77.30 through R82.10) up to specific Jumbo Hotfix Takes, but real-world exploitability hinges on the Management Server being network-reachable without firewall protection or without a restrictive Trusted Clients policy. At time of analysis there is no public exploit identified and no CISA KEV listing, so this is a high-severity but not-yet-weaponized issue.
Technical ContextAI
The affected component is Check Point's central management plane - Quantum Security Management (formerly SmartCenter, cpe:2.3:a:checkpoint:quantum_security_management) and its multi-tenant variant Multi-Domain Security Management (cpe:2.3:a:checkpoint:multi-domain_security_management), the servers that define and push security policy to distributed Security Gateways. The root cause is CWE-287 (Improper Authentication): a flaw in how the management service validates a client's identity permits an attacker to be treated as an authenticated administrator without valid credentials. Because the Management Server is the policy authority for the fleet, an authentication defect here has downstream reach - the same trust relationship used to legitimately administer gateways can be abused to issue commands to them, which is why the advisory notes possible command execution on managed gateways.
RemediationAI
Apply the fixed Jumbo Hotfix Take for your train per Check Point advisory sk185152 (https://support.checkpoint.com/results/sk/sk185152): install a Take above the vulnerable ceiling - for Quantum and Multi-Domain Security Management that means R82.10 Jumbo Hotfix Take 37 or later, R82 Take 119 or later, and R81.20 Take 159 or later; end-of-support trains (R81.10, R81, R80.30, R80.20, R80.10, R80, R77.30) should be migrated to a supported, patched release since fixed Takes may not be offered. As compensating controls until patched, ensure the Management Server is not reachable from untrusted networks - place it behind a firewall/management-only segment and block external access to its administrative service ports (trade-off: none for legitimate use if admins already connect from a management LAN), and tighten the Trusted Clients / GUI Clients configuration to an explicit allowlist of specific admin IP addresses rather than 'Any' (trade-off: SmartConsole/API access from non-listed hosts will break and must be pre-registered). These two controls directly negate the stated exploitation prerequisites.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today