Check Point has disclosed CVE-2026-18574, a critical authentication bypass affecting the Security Management Server and Multi-Domain Security Management Server.
An unauthenticated remote attacker with network access to Management services may be able to execute arbitrary commands. Successful exploitation could result in full compromise of the Security Management system.
The vulnerability was discovered internally by Check Point, and the company currently has no indication of active exploitation. This is important: the disclosure demonstrates that Check Point identified and corrected the issue through its internal security-review process before confirmed exploitation was observed. (Checkpoint Support)
However, the absence of known exploitation must not be interpreted as permission to delay remediation.
Once a critical vulnerability becomes public, the time available to patch safely begins to decrease.
Why This Vulnerability Is Critical
The Management Server is one of the most privileged components in a Check Point environment.
It controls:
-
Security policies
-
Network and service objects
-
Administrator permissions
-
Managed gateways and clusters
-
VPN configurations
-
Threat Prevention policy
-
Policy installation
-
Logs and operational visibility
-
Management APIs and automation
Compromising the Management Plane can undermine the trust model of the entire security architecture.
This is not simply a SmartConsole-access issue. CVE-2026-18574 may allow an unauthenticated attacker to execute commands on the Management Server, potentially leading to full system compromise. (CVE)
Affected and Corrected Releases
Check Point published the correction through release-specific Jumbo Hotfix Accumulators.
| Release |
Corrected Jumbo Hotfix |
| R81.20 |
Take 161 or higher |
| R82 |
Take 122 or higher |
| R82.10 |
Take 40 or higher |
R82 Take 122 and R82.10 Take 40 were released on August 3, 2026, and explicitly include the correction for CVE-2026-18574. (Checkpoint Support)
For older affected releases, review sk185222 and evaluate migration to a currently supported version.
Always verify the latest revision of the SK before installation. The required Take may change as newer cumulative packages are released.
Immediate Technical Recommendations
1. Identify Every Affected Management Server
Inventory all:
-
Security Management Servers
-
Multi-Domain Servers
-
Management HA members
-
Dedicated Domain Management Servers
-
Systems restored for disaster recovery or testing
-
Management servers in isolated or cloud environments
Confirm the installed release and Jumbo Hotfix level.
Useful commands include:
cpinfo -y all
From Gaia Clish:
show installer packages installed
Do not assume that a standby, laboratory, or disaster-recovery Management Server presents no risk. If it is powered on and reachable, it must be evaluated.
2. Restrict Management Network Exposure
Before the maintenance window, reduce the reachable attack surface.
-
Do not expose Management services directly to the Internet.
-
Restrict Trusted Clients to explicit administrative IP addresses or subnets.
-
Remove broad definitions such as Any.
-
Permit administrative access only through a dedicated management network, VPN, or hardened jump host.
-
Review cloud security groups, ACLs, firewall rules, NAT, and temporary troubleshooting access.
-
Restrict access from user VLANs and third-party networks.
-
Confirm that only required systems can reach Management services.
These measures reduce exposure, but they do not remove the vulnerable code.
Network restriction is mitigation. Installing the corrected Jumbo Hotfix is remediation.
. Prepare the Change Correctly
Before installation:
-
Review sk185222.
-
Read the Critical Information and release notes for the target Take.
-
Confirm package compatibility with the exact release and server role.
-
Verify available disk space.
-
Update the CPUSE Deployment Agent where required.
-
Create a valid backup and snapshot.
-
Collect a recent CPInfo.
-
Document the current Management HA status.
-
Confirm SmartConsole access and policy-installation health.
-
Define and test the rollback procedure.
In Management HA or Multi-Domain environments, follow the product-specific installation sequence. Do not update all Management components simultaneously without validating each stage.
4. Install the Corrected Jumbo Hotfix
Install the release-specific corrected Take:
R81.20 -> Take 161 or higher
R82 -> Take 122 or higher
R82.10 -> Take 40 or higher
Use Gaia Portal, CPUSE CLI, or another officially supported installation method for the architecture.
Do not select a package only because it is installed successfully in another environment. Confirm:
-
Exact product release
-
Management role
-
Current Jumbo Take
-
Management HA architecture
-
Multi-Domain requirements
-
Available disk space
-
Known limitations
-
Required maintenance impact
Post-Installation Validation
After the server returns, confirm that the correction is installed and that Management operations remain healthy.
Package validation
cpinfo -y all
Or from Gaia Clish:
show installer packages installed
Process validation
cpwd_admin list
For a Security Management Server:
api status
For Multi-Domain Management:
mdsstat
Also validate:
-
SmartConsole authentication
-
Administrator roles
-
SIC communication
-
Access Control policy installation
-
Threat Prevention policy installation
-
Log reception
-
SmartEvent and Log Server connectivity
-
Management HA synchronization
-
Domain status in MDS
-
API integrations
-
Backup operations
-
CPU, memory, and disk usage
A completed CPUSE task is not sufficient evidence that remediation was successful.
Review for Suspicious Activity
Check Point currently reports no indication of active exploitation. Nevertheless, organizations with broadly reachable Management services should review recent activity. (Checkpoint Support)
Look for unexpected:
-
Administrator sessions
-
Management API operations
-
Policy changes
-
Object modifications
-
Administrator or permission changes
-
Policy installations
-
New access paths to Management
-
Operating-system commands or processes
-
Changes to scripts, scheduled tasks, or system files
If the Management Server was directly exposed to the Internet or suspicious activity is identified:
-
Preserve logs and forensic evidence.
-
Avoid deleting potentially relevant data.
-
Contact Check Point Support.
-
Engage the incident-response team.
-
Review the integrity of policies, objects, administrators, and managed gateways.
Final Recommendation
Check Point deserves recognition for identifying CVE-2026-18574 internally and publishing corrections before active exploitation was confirmed.
That does not reduce the urgency of the update.
It provides customers with an opportunity to remediate before the vulnerability is potentially weaponized.
The recommended response is:
Identify affected Management Servers
↓
Restrict Management exposure
↓
Back up and prepare rollback
↓
Install the corrected Jumbo Hotfix
↓
Validate Management operations
↓
Review for suspicious activity
↓
Continue monitoring
The Management Plane should be treated as Tier-0 security infrastructure.
Protecting gateways while leaving the system that controls their policies vulnerable is not a complete security architecture.
Official Reference
sk185222 — CVE-2026-18574: Management Authentication Bypass
How quickly can your organization identify every Management Server, restrict its exposure, apply the corrected Take, and validate that the Management Plane remains trusted?
#CheckPoint #CVE202618574 #SecurityManagement #MultiDomainManagement #CyberSecurity #VulnerabilityManagement #IncidentResponse #CheckMates
