EUVD-2026-47701
GHSA-qg2m-c9gf-4qvp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network auth-bypass yields admin command execution (PR:N, C:H/I:H); S:C because control extends from the Management Server to separate managed gateways; A:N as no availability impact is described.
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4DescriptionCVE.org
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security Gateways. Exploitation requires network access to the Management Server without firewall protection or a configuration that does not restrict Trusted Clients.
AnalysisAI
Authentication bypass in Check Point Quantum Security Management and Multi-Domain Security Management lets an unauthenticated remote attacker (CVSS:3.1 PR:N) run administrative commands directly on the Management Server, and potentially pivot to command execution on the managed Security Gateways it controls. It affects a broad range of releases (R77.30 through R82.10) up to specific Jumbo Hotfix Takes, but real-world exploitability hinges on the Management Server being network-reachable without firewall protection or without a restrictive Trusted Clients policy. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two concrete prerequisites come straight from the advisory: the Management Server must be network-reachable without firewall protection, OR it must run a configuration that does not restrict Trusted Clients (i.e., the Trusted/GUI Clients list is open rather than scoped to specific admin hosts). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes an easy, network-reachable, unauthenticated attack with high confidentiality and integrity impact and no availability impact - consistent with an admin-command-execution authentication bypass. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach an exposed Check Point Management Server - for example one left accessible over a flat internal network or with Trusted Clients set to 'Any' - sends crafted requests that bypass authentication and are processed as administrative commands, with no credentials or user interaction required (AV:N/AC:L/PR:N/UI:N). Having gained management-plane control, the attacker leverages the server's trust relationship to push commands to managed Security Gateways, potentially altering policy or executing commands across the firewall fleet. … |
| Remediation | Apply the fixed Jumbo Hotfix Take for your train per Check Point advisory sk185152 (https://support.checkpoint.com/results/sk/sk185152): install a Take above the vulnerable ceiling - for Quantum and Multi-Domain Security Management that means R82.10 Jumbo Hotfix Take 37 or later, R82 Take 119 or later, and R81.20 Take 159 or later; end-of-support trains (R81.10, R81, R80.30, R80.20, R80.10, R80, R77.30) should be migrated to a supported, patched release since fixed Takes may not be offered. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all Check Point Quantum and Multi-Domain Security Management instances (R77.30-R82.10) in your environment, focusing on network accessibility; immediately apply firewall rules to restrict connections to known trusted administrative IP ranges and eliminate direct internet access to management servers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Checkpoint
View allbackend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security clien
Multiple unspecified vulnerabilities in Check Point Security Gateway 80 R71.x before R71.45 (730159141) and R75.20.x bef
Arbitrary code execution via torch-checkpoint-shrink.py script in ml-engineering project allows remote attackers to exec
Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without us
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today