CVE-2026-18574

Authentication Bypass in Check Point Security Management Server

State: Published
Severity: 9.3 Critical
Published: Aug 3, 2026
Updated: Aug 5, 2026
Reserved: Aug 2, 2026

Description

An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system. Check Point discovered this issue internally and has no indication of active exploitation.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	checkpoint

Weaknesses

CWE-288 Authentication Bypass Using an Alternate Path or Channel

Affected Products

Product	Versions
Security Management Servercheckpoint	R82.10 with Jumbo Hotfix Accumulator Take 39 or belowAffected R82 with Jumbo Hotfix Accumulator Take 121 or belowAffected R81.20 with Jumbo Hotfix Accumulator Take 160 or belowAffected R81.10Affected R81Affected R80.40Affected R80.30Affected R80.20Affected R80.10Affected R80Affected
Multi-Domain Security Management Servercheckpoint	R82.10 with Jumbo Hotfix Accumulator Take 39 or belowAffected R82 with Jumbo Hotfix Accumulator Take 121 or belowAffected R81.20 with Jumbo Hotfix Accumulator Take 160 or belowAffected R81.10Affected R81Affected R80.40Affected R80.30Affected R80.20Affected R80.10Affected R80Affected

References

Check Point Security Advisory sk185222vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.