EUVD-2026-52265
GHSA-79qj-wj2w-h4v7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Pre-auth network-reachable command execution with no user interaction gives AV:N/AC:L/PR:N/UI:N, and full compromise of the server yields C:H/I:H/A:H with scope unchanged.
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
Lifecycle Timeline
2DescriptionCVE.org
An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system. Check Point discovered this issue internally and has no indication of active exploitation.
AnalysisAI
Authentication bypass in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) lets an unauthenticated remote attacker with network access to Management services execute arbitrary commands and fully compromise the management system. It affects a broad range of releases (R80 through R82.10) including R81.20 and R82 running Jumbo Hotfix Accumulator takes at or below fixed thresholds. There is no public exploit identified at time of analysis; Check Point found the flaw internally and reports no indication of active exploitation despite the critical CVSS 4.0 score of 9.3.
Technical ContextAI
The affected component is Check Point's centralized management plane - the Security Management Server (SMS) and its multi-tenant Multi-Domain (MDS) variant - which stores the security policy, object database, and administrator credentials for an entire Check Point gateway estate and communicates over Management services (SIC / management API and related ports). CWE-288 (Authentication Bypass Using an Alternate Path or Channel) indicates the authentication logic can be circumvented via a path that does not enforce the intended credential check, allowing the attacker to reach privileged management functionality that then permits arbitrary command execution. The CPE data scopes exposure to cpe:2.3:a:checkpoint:security_management_server and cpe:2.3:a:checkpoint:multi-domain_security_management_server across all versions, with the EUVD version list narrowing exact remediation to specific Jumbo Hotfix Accumulator takes.
RemediationAI
Apply the fixed Jumbo Hotfix Accumulator for your release as directed in Check Point advisory sk185222 (https://support.checkpoint.com/results/sk/sk185222): update R81.20 SMS/MDS beyond Take 160, R82 SMS/MDS beyond Take 121, and R82.10 SMS/MDS beyond Take 39; end-of-support branches (R80.x, R81, R81.10) should be migrated to a supported, patched release since a fixed take may not be published for them. Confirm exact patched take numbers against sk185222 before deployment rather than relying on inferred versions. Until patched, reduce exposure by restricting network access to the Management services so only trusted management workstations and jump hosts can reach the SMS/MDS (firewall rules / management-network segmentation) - the trade-off is potential disruption to remote administration and API automation, which must be re-allowlisted. Do not expose the Security Management Server to untrusted networks or the internet.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
PyTorch is a Python package that provides tensor computation. [CVSS 8.8 HIGH]
Check Point ZoneAlarm Extreme Security before 15.8.211.19229 allows local users to escalate privileges. Rated high sever
Remote code execution in PyTorch Lightning through 2.6.5 allows an attacker who can get a victim to load a malicious che
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today