CVE-2026-18574: Check Point Security Management Auth Bypass

CVE-2026-18574 Overview

CVE-2026-18574 is an authentication bypass vulnerability affecting Check Point Security Management Server and Multi-Domain Security Management Server (MDS). An unauthenticated remote attacker with network access to the Management services can execute arbitrary commands on the Security Management Server. Successful exploitation results in full compromise of the Security Management system.

Check Point discovered the issue internally and reports no indication of active exploitation. The weakness is classified under CWE-288: Authentication Bypass Using an Alternate Path or Channel.

Critical Impact
Unauthenticated remote command execution on a centralized security management plane grants attackers control over firewall policy, logging, and downstream enforcement points.

Affected Products

Check Point Security Management Server
Check Point Multi-Domain Security Management Server (MDS)
Refer to the Check Point Security Advisory sk185222 for specific affected versions and fixed builds

Discovery Timeline

2026-08-03 - CVE-2026-18574 published to the National Vulnerability Database
2026-08-05 - Entry last modified in the NVD database

Technical Details for CVE-2026-18574

Vulnerability Analysis

CVE-2026-18574 is an authentication bypass in the Management services exposed by Check Point Security Management Server and MDS. The flaw permits an attacker who can reach the management interface over the network to skip authentication controls entirely. Once the bypass succeeds, the attacker can invoke functionality that executes arbitrary operating system commands on the underlying appliance.

Because the Security Management Server is the control plane for enforcement gateways, compromise extends beyond a single host. An attacker can modify security policy, exfiltrate logs, disable inspection, and pivot into segments protected by managed gateways.

Root Cause

The weakness is categorized as [CWE-288]. This class of defect occurs when an application enforces authentication on a primary code path but exposes an alternate channel that reaches privileged functionality without validating the caller. Check Point's advisory sk185222 is the authoritative source for the specific component and code path.

Attack Vector

Exploitation requires only network reachability to Management services. No credentials, user interaction, or prior foothold is needed. The advisory does not describe pre-conditions beyond network access to the management plane.

The vulnerability manifests in the Management services authentication flow. Refer to the Check Point Security Advisory sk185222 for detailed technical guidance and vendor-provided remediation steps.

Detection Methods for CVE-2026-18574

Indicators of Compromise

Unexpected process execution or shell activity on the Security Management Server outside of scheduled administrative windows
New or modified administrator accounts, API keys, or SmartConsole sessions without a corresponding change request
Unexplained policy installations, revisions, or exports issued from the management plane
Inbound connections to Management service ports from IP ranges that are not part of the documented administrative network

Detection Strategies

Alert on authentication events to Management services that reach privileged endpoints without a preceding successful login record
Baseline command-line and process-tree activity on the management appliance and flag deviations, particularly child processes of management daemons
Correlate configuration changes in the management database with the identity, source IP, and session that produced them

Monitoring Recommendations

Forward Check Point management audit logs, SmartConsole session records, and OS-level shell history to a centralized SIEM for retention and correlation
Restrict and continuously monitor network reachability to Management service ports; treat any external exposure as a high-priority finding
Use endpoint telemetry on the management host to record process execution, file writes to policy directories, and outbound connections initiated by management services

How to Mitigate CVE-2026-18574

Immediate Actions Required

Apply the fixes referenced in Check Point sk185222 to all Security Management Server and MDS deployments
Remove any exposure of Management services to untrusted networks, including the public internet, until patching is verified
Review management audit logs, administrator accounts, and recent policy changes for signs of unauthorized activity
Rotate administrator credentials, API keys, and certificates used by the management plane after patching

Patch Information

Check Point has published fixed versions and remediation guidance in advisory sk185222. Administrators should consult the Check Point Security Advisory for the authoritative list of fixed builds for each supported release train of Security Management Server and Multi-Domain Security Management Server.

Workarounds

Restrict access to Management services with network access control lists so only a defined administrative jump host range can connect
Place the management interface on a dedicated out-of-band network segment that is not reachable from user or server VLANs
Enforce multi-factor authentication and session monitoring on any jump host used to administer Check Point management systems
Treat network isolation as a temporary compensating control, not a substitute for applying the vendor patch

bash

# Example: restrict Management service reachability at the host firewall
# Replace 10.10.0.0/24 with your administrative subnet
iptables -A INPUT -p tcp --dport 18190 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 18190 -j DROP
iptables -A INPUT -p tcp --dport 19009 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 19009 -j DROP