Advisoriesby IbisCheck PointCVE-2026-18574
Check Point Multi-Domain Security Management Server: authentication bypass
No fix yet
An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system. Check Point discovered this issue internally and has no indication of active exploitation.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Multi-Domain Security Management Server Product | <= R82.10 with Jumbo Hotfix Accumulator Take 39 or below | No fix yet |
| <= R82 with Jumbo Hotfix Accumulator Take 121 or below | No fix yet | |
| <= R81.20 with Jumbo Hotfix Accumulator Take 160 or below | No fix yet | |
| <= R81.10 | No fix yet | |
| Security Management Server Product | <= R82.10 with Jumbo Hotfix Accumulator Take 39 or below | No fix yet |
| <= R82 with Jumbo Hotfix Accumulator Take 121 or below | No fix yet | |
| <= R81.20 with Jumbo Hotfix Accumulator Take 160 or below | No fix yet | |
| <= R81.10 | No fix yet |
Details and references
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-288