Executive brief
A critical security flaw has been identified in Check Point's central management servers, which are used to control and configure corporate firewalls. An unauthorized attacker could bypass security checks to gain administrative control over the management server and any connected firewalls. This could allow an attacker to disrupt network operations, modify security policies, or gain further access to the internal corporate network.
Technical details
An authentication bypass vulnerability (CWE-287) exists in Check Point Security Management and Multi-Domain Security Management (MDS) servers. The flaw allows an unauthenticated remote attacker to bypass identity verification and execute administrative commands, including 'run-script' and 'exec-command', on the Management Server. Furthermore, this access can be leveraged to execute commands on managed Security Gateways (firewalls). Exploitation is possible if the Management Server is reachable over the network without firewall protection or if 'Trusted Clients' are not restricted to specific IP addresses. Fixes are available in Jumbo Hotfix Accumulators for versions R81.20, R82, and R82.10.
Affected products
- Check Point Quantum Security Management R82.10 (Take 36 and below), R82 (Take 118 and below), R81.20 (Take 158 and below), R81.10, R81, R80.x, R77.30
- Check Point Multi-Domain Security Management (MDS) R82.10 (Take 36 and below), R82 (Take 118 and below), R81.20 (Take 158 and below), R81.10, R81, R80.x, R77.30
Timeline
- 2026-07-14: other: Article created
- 2026-07-22: advisory: Public advisory and CVE published