EUVD-2026-47701
GHSA-qg2m-c9gf-4qvp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Management Server (AV:N)
-
DeliverySend crafted authentication-bypass request
-
ExploitGain administrative command execution
-
ExecutionAbuse trust to command managed gateways
-
ImpactAlter policy / control firewall fleet
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Two concrete prerequisites come straight from the advisory: the Management Server must be network-reachable without firewall protection, OR it must run a configuration that does not restrict Trusted Clients (i.e., the Trusted/GUI Clients list is open rather than scoped to specific admin hosts). Where either holds, exploitation is remote and unauthenticated (PR:N, UI:N, AC:L). The primary LIMITING factor is deployment hardening: in standard Check Point best-practice installs the Management Server sits on an isolated management network behind a firewall and Trusted Clients is restricted to named admin IPs, which prevents the attack - so this is effectively remote-unauthenticated only against non-default or under-segmented deployments. Affected versions are also bounded to the listed R77.30-R82.10 trains at or below the specified Jumbo Hotfix Takes. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes an easy, network-reachable, unauthenticated attack with high confidentiality and integrity impact and no availability impact - consistent with an admin-command-execution authentication bypass. However, the vendor's own exploitation prerequisite meaningfully tempers this: exploitation 'requires network access to the Management Server without firewall protection or a configuration that does not restrict Trusted Clients.' In hardened, best-practice Check Point deployments the Management Server is not internet-facing and Trusted Clients is scoped to specific admin hosts, which sharply narrows the exploitable population versus the raw 9.1 would suggest - an AC:L score against a non-default exposure. There is no EPSS score provided, no CISA KEV entry, and no public POC referenced (VulDB and the Check Point sk185152 advisory are the only sources), so this reads as a serious latent risk rather than confirmed active exploitation. Note the scope tension: CVSS is marked S:U yet the description explicitly allows command execution on managed gateways (a separate system), which arguably warrants a scope change - verify blast radius with the vendor. |
| Exploit ScenarioDerived | An attacker who can reach an exposed Check Point Management Server - for example one left accessible over a flat internal network or with Trusted Clients set to 'Any' - sends crafted requests that bypass authentication and are processed as administrative commands, with no credentials or user interaction required (AV:N/AC:L/PR:N/UI:N). Having gained management-plane control, the attacker leverages the server's trust relationship to push commands to managed Security Gateways, potentially altering policy or executing commands across the firewall fleet. No public exploit code is identified at time of analysis, so this scenario is derived from the CVSS vector and vendor description rather than an observed exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Authentication bypass in Check Point Quantum Security Management and Multi-Domain Security Management lets an unauthenticated remote attacker (CVSS:3.1 PR:N) run administrative commands directly on the Management Server, and potentially pivot to command execution on the managed Security Gateways it controls. It affects a broad range of releases (R77.30 through R82.10) up to specific Jumbo Hotfix Takes, but real-world exploitability hinges on the Management Server being network-reachable without firewall protection or without a restrictive Trusted Clients policy. At time of analysis there is no public exploit identified and no CISA KEV listing, so this is a high-severity but not-yet-weaponized issue.
RemediationAI
Apply the fixed Jumbo Hotfix Take for your train per Check Point advisory sk185152 (https://support.checkpoint.com/results/sk/sk185152): install a Take above the vulnerable ceiling - for Quantum and Multi-Domain Security Management that means R82.10 Jumbo Hotfix Take 37 or later, R82 Take 119 or later, and R81.20 Take 159 or later; end-of-support trains (R81.10, R81, R80.30, R80.20, R80.10, R80, R77.30) should be migrated to a supported, patched release since fixed Takes may not be offered. As compensating controls until patched, ensure the Management Server is not reachable from untrusted networks - place it behind a firewall/management-only segment and block external access to its administrative service ports (trade-off: none for legitimate use if admins already connect from a management LAN), and tighten the Trusted Clients / GUI Clients configuration to an explicit allowlist of specific admin IP addresses rather than 'Any' (trade-off: SmartConsole/API access from non-listed hosts will break and must be pre-registered). These two controls directly negate the stated exploitation prerequisites.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is Check Point's central management plane - Quantum Security Management (formerly SmartCenter, cpe:2.3:a:checkpoint:quantum_security_management) and its multi-tenant variant Multi-Domain Security Management (cpe:2.3:a:checkpoint:multi-domain_security_management), the servers that define and push security policy to distributed Security Gateways. The root cause is CWE-287 (Improper Authentication): a flaw in how the management service validates a client's identity permits an attacker to be treated as an authenticated administrator without valid credentials. Because the Management Server is the policy authority for the fleet, an authentication defect here has downstream reach - the same trust relationship used to legitimately administer gateways can be abused to issue commands to them, which is why the advisory notes possible command execution on managed gateways.
Know when Checkpoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Unauthenticated network auth-bypass yields admin command execution (PR:N, C:H/I:H); S:C because control extends from the Management Server to separate managed gateways; A:N as no availability impact is described.
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
Lifecycle Timeline
3DescriptionCVE.org
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security Gateways. Exploitation requires network access to the Management Server without firewall protection or a configuration that does not restrict Trusted Clients.
Executive ViewAI
Check Point Quantum and Multi-Domain Security Management contain a critical authentication bypass (CVE-2026-62144) that allows unauthenticated attackers to execute administrative commands on network management servers controlling enterprise security gateways. No public exploit identified at time of analysis, but any internet-exposed or inadequately protected management server represents unacceptable organizational risk. Attackers exploiting this vulnerability would gain direct control of the security infrastructure protecting the enterprise perimeter.
No vendor-released patch identified at time of analysis. Restrict network access to management servers using firewall rules, limiting connections to trusted administrative IP ranges only; implement or strengthen Trusted Clients policies to restrict which hosts can execute administrative commands; ensure management servers are isolated to internal networks and not directly internet-accessible; apply the latest available Jumbo Hotfix Take for your release branch as a temporary measure pending an official patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Exploit-DB