--- schema: 1 kind: vulnerability title: "CVE-2026-18574 — Check Point Security Management: unauthenticated bypass of management authentication to arbitrary command execution, with no fix for seven end-of-support trains" headline: "A fourth Check Point management-plane CVE in two weeks — and every end-of-support train is unfixed" summary: > Check Point disclosed CVE-2026-18574 in sk185222 (created 2026-08-01, last modified 2026-08-03): an unauthenticated attacker with network reach to a Security Management or Multi-Domain Security Management Server can bypass management authentication and execute arbitrary commands, which Check Point states could result in full compromise of the management system. Fixes ship in the Jumbo Hotfix Accumulator for R81.20 (Take 161), R82 (Take 122) and R82.10 (Take 40) — but the advisory also lists R80, R80.10, R80.20, R80.30, R80.40, R81 and R81.10 as affected, all end-of-support, with no fix on offer. It is the fourth CVE disclosed on this management surface in roughly two weeks, and the second of them an authentication bypass. discovered_at: "2026-08-05T04:12:23Z" event_date: "2026-08-03" run_id: 2026-08-05T0412Z-intel priority: high immediate_action: null tags: [vulnerabilities, auth-bypass, pre-auth, rce, patch-available, no-patch] regions: [global, europe, switzerland] sectors: [public-sector, energy, finance, telco] entities: [] techniques: [T1190, T1059] affected_products: ["Check Point Security Management", "Check Point Multi-Domain Security Management"] cves: - id: CVE-2026-18574 cvss: null epss: null type: auth-bypass vector: zero-click auth: pre-auth status: [patch-available, no-patch] affected: "Security Management Server and Multi-Domain Security Management Server on R81.20, R82 and R82.10; also R80, R80.10, R80.20, R80.30, R80.40, R81 and R81.10, which Check Point marks end-of-support. Smart-1 Cloud customers are stated to be already protected." fixed: "Jumbo Hotfix Accumulator for R81.20 from Take 161, for R82 from Take 122, for R82.10 from Take 40. No fix is offered for any of the end-of-support trains." sources: - url: "https://support.checkpoint.com/results/sk/sk185222" publisher: "Check Point Software Technologies" date: "2026-08-03" role: primary - url: "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0965/" publisher: "CERT-FR / ANSSI" date: "2026-08-04" role: corroborating - url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2628" publisher: "BSI CERT-Bund" date: "2026-08-04" role: corroborating closed_sources: [] evidence: - quote: "An unauthenticated attacker may be able to bypass Management authentication and execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system." publisher: "Check Point Software Technologies" - quote: "This issue was discovered internally, and Check Point has no indication of active exploits." publisher: "Check Point Software Technologies" verification: multi-source sourcing_note: "Check Point's own advisory is the primary and the only party stating the affected-version list and the vendor's exploitation assessment; CERT-FR and BSI CERT-Bund independently relayed the flaw on 2026-08-04. No CVSS score has been published by Check Point, CERT-FR or BSI — the vendor severity is High." confidence: high update_of: null references: - 2026-07-23/check-point-smartconsole-auth-bypass-cve-2026-16232 deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 2 watchlist_hit: false actions: - "Apply Jumbo Hotfix Accumulator Take 161 (R81.20), Take 122 (R82) or Take 40 (R82.10) to every Security Management and Multi-Domain Management Server, and for any R80.x / R81 / R81.10 server — where no fix exists — restrict the management interface to the administrative network now, because that is the only control available." - "Set Trusted Clients on every management server to explicit hosts and subnets and remove any 'Any' definition, which Check Point names as the configuration that increases exposure to this flaw." migrated_from: null --- Check Point disclosed CVE-2026-18574 in support article sk185222, created 2026-08-01 and last modified 2026-08-03: an unauthenticated attacker may be able to bypass management authentication and execute arbitrary commands on the Security Management Server, with successful exploitation resulting in full compromise of the management system ([Check Point, 2026-08-03](https://support.checkpoint.com/results/sk/sk185222)). CERT-FR issued CERTFR-2026-AVI-0965 on 2026-08-04, describing the effect as remote arbitrary code execution together with a security-policy bypass ([CERT-FR, 2026-08-04](https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0965/)), and BSI CERT-Bund published WID-SEC-2026-2628 the same day ([BSI CERT-Bund, 2026-08-04](https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2628)). No party has published a CVSS score; Check Point rates the advisory High. The affected product is the estate's policy authority, not an edge device. A Security Management or Multi-Domain Management Server holds the policy database, the object database, administrator accounts and the SIC trust material for every gateway it manages, so command execution there is a whole-perimeter problem rather than a single-host one. The single stated precondition is reachability: Check Point's advisory records that successful exploitation requires network access to the Security Management Server, and that environments which do not restrict Trusted Clients, or which expose management services to untrusted networks, may have increased exposure ([Check Point, 2026-08-03](https://support.checkpoint.com/results/sk/sk185222)). **The end-of-support gap is the sharpest fact here.** Check Point's fix list covers three trains — Jumbo Hotfix Accumulator Take 161 on R81.20, Take 122 on R82, Take 40 on R82.10 — while its affected-versions list additionally names R80, R80.10, R80.20, R80.30, R80.40, R81 and R81.10, all marked end-of-support ([Check Point, 2026-08-03](https://support.checkpoint.com/results/sk/sk185222)). For an estate still running any of those, there is no patch to apply and no vendor fix coming; the answer is an upgrade programme or network containment, and containment is the only one available this week. Smart-1 Cloud customers are stated to be already protected. Check Point states the issue was discovered internally and that it has no indication of active exploits ([Check Point, 2026-08-03](https://support.checkpoint.com/results/sk/sk185222)). That is the vendor's assessment as of 2026-08-03 and is worth weighing against this product surface's recent record rather than reading as a grace period: CVE-2026-16232, an authentication bypass in the SmartConsole login path on the same management servers, went from disclosure to confirmed in-the-wild exploitation and a CISA KEV listing within days in July, and its root cause turned out to be a caller-supplied identity value the server trusted, on a configuration that was the default in testing. Two further CVEs in the same bundle followed a week later — an unauthenticated command-execution flaw and a Gaia Portal privilege escalation. Counting those, this is the fourth CVE on this management surface in roughly two weeks and the second authentication bypass among them. Detection concepts, telemetry class first. Management-plane authentication logs are the primary surface: successful administrative sessions on the management server that are not preceded by a matching client authentication, sessions whose source address sits outside the Trusted Clients definition, and policy-install, object-modification or administrator-creation events that do not correlate with a preceding interactive administrator login. Because this flaw reaches command execution, host process-creation telemetry on the management server itself is the second anchor — shells or interpreters spawned by the management daemons are not part of normal operation. **Triage:** legitimate automation produces administrative API activity without an interactive login too — CI-driven policy pushes, configuration-management integrations and scheduled management jobs all look like that. The discriminators are the source address measured against the Trusted Clients definition, which API identity is in use, and whether the activity falls inside a known scheduled window; all three should be a small fixed set on a healthy management network. **Defender takeaway:** patch the three supported trains now, and treat the stated precondition as the durable control — a management interface reachable only from a dedicated administrative network is not exposed to this flaw, nor to the three that preceded it in the same stack this fortnight. That single architectural property is doing more work here than any of the four individual fixes.