{"uuid": "0fafb38a-b469-4b5f-9143-f06953db833a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-18574", "type": "seen", "source": "https://gist.github.com/alon710/708ecd948f9cc7bf7b4587e41495dfe8", "content": "# CVE-2026-18574: CVE-2026-18574: Authentication Bypass via Alternate Path in Check Point Security Management Server\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-08-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-18574\n\n## Summary\nA critical authentication bypass vulnerability (CVE-2026-18574) in Check Point Security Management and Multi-Domain Security Management (MDS) Servers allows unauthenticated remote attackers to execute arbitrary system commands with administrative privileges. The flaw stems from an alternate path authentication bypass (CWE-288) in the management interface daemons.\n\n## TL;DR\nUnauthenticated remote command execution on Check Point Security Management Servers via alternate path authentication bypass (CWE-288), CVSS 9.3.\n\n## Technical Details\n\n- **CWE ID**: CWE-288\n- **Attack Vector**: Network\n- **CVSS**: 9.3\n- **EPSS**: Not assigned\n- **Impact**: Arbitrary Command Execution / Full Compromise\n- **Exploit Status**: None\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Check Point Security Management Server\n- Check Point Multi-Domain Security Management Server (MDS)\n- **Check Point Security Management Server / MDS**: R81.20 (Fixed in: `R81.20 Jumbo HFA Take 161`)\n- **Check Point Security Management Server / MDS**: R82 (Fixed in: `R82 Jumbo HFA Take 122`)\n- **Check Point Security Management Server / MDS**: R82.10 (Fixed in: `R82.10 Jumbo HFA Take 40`)\n\n## Mitigation\n\n- Apply Jumbo Hotfix Accumulator updates for R81.20, R82, or R82.10 immediately.\n- Restrict administrative GUI clients (Trusted Clients) in SmartConsole to authorized IPs.\n- Isolate administrative ports (TCP 18190, 443, 19009) from untrusted networks and the public internet.\n\n**Remediation Steps:**\n1. Identify current software version and Jumbo Hotfix Take running on the Security Management Server or Multi-Domain Server.\n2. For R82.10, install Jumbo Hotfix Accumulator starting from Take 40.\n3. For R82, install Jumbo Hotfix Accumulator starting from Take 122.\n4. For R81.20, install Jumbo Hotfix Accumulator starting from Take 161.\n5. For legacy versions (R81.10, R81, R80.x), upgrade to a supported release first.\n6. Open SmartConsole, navigate to Manage & Settings > Permissions & Administrators > Trusted Clients, and restrict access to authorized administration hosts.\n7. Apply firewall rules to enforce network-level restrictions on administrative ports.\n\n## References\n\n- [Check Point Support Advisory sk185222](https://support.checkpoint.com/results/sk/sk185222)\n- [Official CVE Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-18574)\n- [Check Point Gateway and Management Hardening Guide](https://sc1.checkpoint.com/documents/Check_Point_Gateway_and_Management_Hardening/CP_Check_Point_Gateway_and_Management_Hardening.pdf)\n- [Jumbo Hotfix Accumulator for R82.10 Home Page](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm)\n- [Jumbo Hotfix Accumulator for R82 Home Page](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm)\n- [Jumbo Hotfix Accumulator for R81.20 Home Page](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-18574) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-04T10:01:35.613418Z"}