EUVD-2026-47700
GHSA-m2xx-23gx-734v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated token forgery yields full admin control of the management server, so PR:N/UI:N with high C/I/A; scope unchanged as impact stays within the compromised server's authority.
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
Lifecycle Timeline
8DescriptionCVE.org
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
Articles & Coverage 1
AnalysisAI
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid application login token and log in with full administrative privileges to Quantum Security Management and Multi-Domain Security Management servers (CWE-287, CVSS 4.0 9.3). Once authenticated, the attacker can rewrite security policies and configurations across managed gateways. It is confirmed actively exploited (CISA KEV) with publicly available exploit code, though Check Point reports only a very small number of affected customers, and the EPSS score is a modest 1.07% (61st percentile), consistent with targeted rather than mass exploitation.
Technical ContextAI
The flaw sits in the SmartConsole login flow of Check Point's centralized management plane - the Security Management Server (Quantum Security Management) and its multi-tenant variant (Multi-Domain Security Management), identified by CPEs cpe:2.3:a:checkpoint:quantum_security_management and cpe:2.3:a:checkpoint:multi-domain_security_management. These servers are the administrative brain of a Check Point deployment: administrators use the SmartConsole client to author and push firewall/security policy to managed gateways. The root-cause class is CWE-287 (Improper Authentication): the login process can be coerced into issuing an application login token to a party who never proved a valid identity, so the token - not credentials - becomes the authenticator, and the attacker inherits an authenticated administrative session. Because the token grants the same authority as a legitimate admin, this is an authentication bypass rather than a privilege-escalation-after-login issue.
RemediationAI
Apply the fixing Jumbo Hotfix Accumulator for your train as directed in Check Point advisory sk185169 (https://support.checkpoint.com/results/sk/sk185169): move R81.20 above Jumbo Hotfix Take 158, R82 above Take 118, and R82.10 above Take 36; the exact fixed Take beyond the last-vulnerable values above is not enumerated in the provided data, so pull the current recommended Take directly from sk185169 rather than assuming a number. Systems on the legacy trains (R81.10, R81, R80.30, R80.20, R80.10, R80, R77.30) should be upgraded to a supported, patched release. The most effective compensating control, and the one that maps directly to the stated exploitation prerequisite, is to restrict Trusted Clients on the Management Server so that only known administrator source IPs may connect to SmartConsole/management services - this removes the internet-reachable, unrestricted-client condition the exploit needs, at the cost of having to maintain an accurate admin IP allowlist. Additionally, remove the Management Server IP from direct internet exposure (place it behind VPN/jump host and block external access to management ports), and review recent policy/configuration changes and admin sessions for signs of unauthorized modification given confirmed active exploitation.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH lo
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today