Vulnerability

CERT-In Vulnerability Note CIVN-2026-0395
Authentication Bypass Vulnerability in Check Point

Original Issue Date:August 06, 2026

Severity Rating: HIGH

Software Affected

Security Management Server, Multi-Domain Security Management Server versions R80, R80.10, R80.20, R80.30, R80.40, R81, R81.10 (All End of Support), R81.20, R82, R82.10

Overview

A vulnerability has been reported in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) which may allow a remote unauthenticated attacker to bypass the Management authentication mechanism and execute arbitrary commands on the Security Management Server.

Target Audience:
Organizations and administrators using the affected Check Point Security Management Server and Multi-Domain Security Management Server (MDS).

Risk Assessment:
High risk of authentication bypass, arbitrary command execution, and complete compromise of the server.

Impact Assessment:
Authentication bypass, arbitrary command execution, unauthorized administrative access, and complete compromise of the Server.

Description

Check Point Security Management Server and Multi-Domain Security Management Server (MDS) are centralized management platforms used for administering and enforcing security policies across Check Point security gateways.

This vulnerability exists due to an authentication bypass flaw in the Management Server. An unauthenticated attacker with network access to the Management Server may exploit this vulnerability to bypass the authentication mechanism and execute arbitrary commands on the affected system.

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized administrative access, execute arbitrary commands, and completely compromise the affected Check Point Security Management Server.

Solution

Users are advised to apply appropriate updates as mentioned:
https://support.checkpoint.com/results/sk/sk185222

Vendor Information

https://support.checkpoint.com/

References

https://support.checkpoint.com/results/sk/sk185222

CVE Name
CVE-2026-18574

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India