CVE-2026-62144: Check Point Management Auth Bypass Flaw

CVE-2026-62144 Overview

CVE-2026-62144 is an authentication bypass vulnerability affecting Check Point Security Management and Multi-Domain Security Management. An unauthenticated remote attacker can execute administrative commands directly on the Management Server. Successful exploitation may also enable command execution on managed Security Gateways, extending impact across the protected network perimeter.

The flaw is categorized under [CWE-287] Improper Authentication and carries a CVSS 3.1 base score of 9.1. Exploitation requires network access to the Management Server when the server is not protected by a firewall or when the Trusted Clients configuration does not restrict inbound sources.

Critical Impact
Unauthenticated attackers with network reachability to the Management Server can run administrative commands, pivot to managed Security Gateways, and compromise the entire firewall policy enforcement chain.

Affected Products

Check Point Security Management Server
Check Point Multi-Domain Security Management (Provider-1)
Managed Security Gateways reachable from a compromised Management Server

Discovery Timeline

2026-07-22 - CVE-2026-62144 published to the National Vulnerability Database
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-62144

Vulnerability Analysis

The vulnerability resides in the authentication logic of the Check Point Management Server. An attacker who can reach the Management Server over the network can bypass authentication controls and invoke administrative command interfaces without valid credentials.

Because the Management Server orchestrates policy for downstream Security Gateways, command execution on the manager can cascade into command execution on gateways it controls. This turns a single exposed manager into a route toward network-wide compromise. The Check Point advisory tracked as sk185152 documents affected versions and fixes.

Root Cause

The root cause is improper authentication [CWE-287] in the administrative command handling path. The server accepts and processes privileged requests without validating that the request originates from an authenticated administrator. The Trusted Clients access list, when left unrestricted, removes the network-layer control that would otherwise mitigate the flaw.

Attack Vector

Exploitation is network-based, requires low attack complexity, and needs no privileges or user interaction. The attacker must have TCP-level reachability to the Management Server management interfaces. Two conditions materially raise exposure: absence of a firewall in front of the Management Server, and a Trusted Clients configuration that permits any source address. The vulnerability is not published with a public proof-of-concept, and it is not listed in the CISA Known Exploited Vulnerabilities catalog at time of writing.

No verified exploit code is publicly available. Refer to the Check Point Security Advisory sk185152 for vendor-provided technical detail.

Detection Methods for CVE-2026-62144

Indicators of Compromise

Unexpected administrative API or CLI sessions on the Management Server originating from external or non-administrator source IP addresses.
New or modified policy objects, administrator accounts, or gateway push operations performed outside of change-control windows.
Command execution artifacts on managed Security Gateways that correlate with policy installations from the Management Server.

Detection Strategies

Review Management Server audit logs for administrative actions that lack a corresponding authenticated login event.
Alert on any inbound connection to the Management Server management ports from sources outside the documented Trusted Clients allowlist.
Baseline normal fwm, cpm, and API activity and flag deviations, especially command execution paths invoked without a preceding session establishment.

Monitoring Recommendations

Forward Management Server and Multi-Domain Server audit logs to a centralized SIEM for correlation with network flow data.
Monitor for policy installation and script execution events initiated from unfamiliar administrator identities.
Track configuration drift in the Trusted Clients list and alert on any change that broadens allowed source ranges.

How to Mitigate CVE-2026-62144

Immediate Actions Required

Apply the fixes referenced in Check Point sk185152 to all Security Management and Multi-Domain Security Management servers.
Verify that the Management Server is not directly reachable from untrusted networks and place it behind a firewall enforcing strict inbound rules.
Restrict the Trusted Clients (GUI Clients) list to the minimum set of administrator workstation IP addresses.
Rotate administrator credentials and API keys and review recent audit logs for signs of unauthorized administrative activity.

Patch Information

Check Point has published fixed versions and hotfixes under advisory sk185152. Administrators should identify their installed Management Server version and apply the corresponding jumbo hotfix or upgrade package listed in the advisory. After patching, validate the fix by reviewing the version banner and confirming that unauthenticated administrative endpoints reject requests.

Workarounds

Place the Management Server behind a network firewall that permits management traffic only from administrator subnets.
Configure the Trusted Clients list on the Management Server to allow only specific administrator IP addresses, avoiding Any or broad CIDR entries.
Segment the management network from user and internet-facing networks and require VPN or bastion access for administrator sessions.

bash

# Configuration example: restrict Trusted Clients via CLI (illustrative)
# Review current GUI clients
cpconfig
# Select: GUI Clients -> remove Any / broad ranges
# Add only administrator workstation IPs, for example:
#   10.20.30.40
#   10.20.30.41
# Save and exit; then restart management services if prompted:
cpstop && cpstart