Vulnerability · Published Aug 3, 2026 · Assigned by checkpoint
CVE-2026-18574Authentication Bypass in Check Point Security Management Server
Critical 9.3
In plain English
A critical-severity authentication bypass in Multi-Domain Security Management Server from checkpoint. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system. Check Point discovered this issue internally and has no indication of active exploitation.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| checkpoint | Security Management Server | R82.10 with Jumbo Hotfix Accumulator Take 39 or belowR82 with Jumbo Hotfix Accumulator Take 121 or belowR81.20 with Jumbo Hotfix Accumulator Take 160 or belowR81.10R81R80.40R80.30R80.20 |
| checkpoint | Multi-Domain Security Management Server | R82.10 with Jumbo Hotfix Accumulator Take 39 or belowR82 with Jumbo Hotfix Accumulator Take 121 or belowR81.20 with Jumbo Hotfix Accumulator Take 160 or belowR81.10R81R80.40R80.30R80.20 |
Weakness: CWE-288 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- Check Point Security Advisory sk185222 vendor-advisory