An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security…

CVE-2026-18574 is a management-plane authentication bypass (CWE-288) in Check Point Security Management Server and Multi-Domain Security Management Server (MDS), disclosed August 3, 2026 via sk185222. It is the third management-auth-bypass CVE disclosed against Check Point management infrastructure in under two weeks, following CVE-2026-16232 (CVSS 9.3, KEV-listed, actively exploited, public PoC) and CVE-2026-62144 (CVSS 9.3). The affected product is the single pane of glass that pushes security policy to every Check Point gateway in the enterprise. Affected versions almost certainly span R81.20 and R82.10 based on the sibling CVEs’ version matrices, and likely extend back through R77.30–R81.10.

There is no vendor CVSS score yet. Based on the CWE (authentication bypass via alternate path/channel), the attack surface (management ports TCP 18190 and 19009), and the direct analogy to CVE-2026-16232 which scored 9.3 and was exploited within days, a CRITICAL assessment is warranted. The management server is not a leaf node — it is the root of trust for every managed gateway. An unauthenticated bypass here is an extinction-level event for the perimeter.

Why this verdict

• Unauthenticated remote attack vector: CWE-288 indicates no credentials are required. Network access to management ports is the only prerequisite, matching the pattern of CVE-2026-16232.
• Role multiplier: The Security Management Server / MDS is *the* canonical high-value-role component for Check Point environments. It is not *sometimes* deployed in a high-value role — it IS the high-value role. 100% of installs are the central policy authority for all managed firewalls. Blast radius: fleet-scale. A successful chain ends in attacker-controlled firewall policy across the entire perimeter. This enforces a CRITICAL floor.
• Sibling CVE precedent: CVE-2026-16232 (identical product, identical CWE class, CVSS 9.3) went from disclosure to active exploitation and KEV listing within days. A public PoC exists. Attackers are already scanning for and exploiting Check Point management auth bypasses. The tooling and targeting are established.
• No friction override available: While best-practice hardening restricts Trusted Clients, Check Point’s own documentation and community threads confirm the default is permissive. The “requires internet exposure” friction point does not break the CRITICAL floor because (a) the management server is the defining component of this role, and (b) demonstrated real-world exploitation of the sibling CVE proves the exposure population is actionable.

Why not higher?

A 9.0 rather than 10.0 because exploitation requires network reachability to management-specific ports (TCP 18190/19009), which are not universally internet-facing. Well-hardened environments with Trusted Client restrictions and management VLANs have meaningful friction. Additionally, no active exploitation or PoC exists for this specific CVE yet.

Why not lower?

Downgrading below CRITICAL would require evidence that the exposure population is negligible (<1% of installs in the high-value role). Since the affected component IS the management plane by definition (100% of installs are high-value), and since the sibling CVE with identical characteristics was actively exploited within days, the CRITICAL floor holds. The “requires management port access” friction is real but insufficient to break floor given demonstrated attacker interest in this exact attack surface.

1. Restrict Trusted Clients to named administrator IPs immediately — In SmartConsole, navigate to Manage & Settings > Blades > Management API > Advanced Settings and set Trusted Clients to specific IP addresses of administrator workstations only. This is the single most effective control — it eliminates remote exploitation from untrusted networks. Deploy within the noisgate mitigation SLA of 3 days for CRITICAL.
2. Block TCP 18190 and 19009 at the perimeter firewall — Ensure no external route exists to management ports. Add explicit deny rules at the perimeter for these ports. If management is co-hosted on a gateway, add implied rules or topology restrictions. Deploy within 3 days.
3. Isolate the management server on a dedicated management VLAN — Network segmentation ensures only authorized jump hosts can reach the SMS/MDS. This limits the blast radius even for internal attackers. If not already in place, prioritize as a 3-day mitigation.
4. Enable MFA for SmartConsole logins — While the auth bypass may circumvent SmartConsole’s native login, MFA via RADIUS/TACACS+ integration adds a layer that token-based bypasses may not automatically defeat. Deploy within 3 days.
5. Monitor audit logs for anomalous management sessions — Alert on SmartConsole logins from unexpected IPs, ‘Authentication method: application token’ entries, and policy installations outside change windows. Feed logs to SIEM with <1hr alert SLA.
6. Apply the sk185222 hotfix as soon as available — Check the Check Point support portal (sk185222) daily for hotfix availability. Apply within the noisgate remediation SLA of 90 days, but target immediate application given the threat landscape.

Run this script on the Check Point management server itself as the admin user in Expert mode (expert command). It checks the installed Jumbo Hotfix take level against known-vulnerable baselines. Example: bash check_cve_2026_18574.sh. Requires Expert mode (root-equivalent) access.

#!/bin/bash
# check_cve_2026_18574.sh
# Checks Check Point Management Server for CVE-2026-18574 vulnerability
# Run on the SMS/MDS in Expert mode
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

echo "=== CVE-2026-18574 Check (sk185222) ==="
echo "Date: $(date)"
echo "Hostname: $(hostname)"

# Check if this is a management server
if ! cpstat mg >/dev/null 2>&1; then
    echo "RESULT: UNKNOWN - This does not appear to be a Check Point Management Server."
    exit 2
fi

# Get installed version
VERSION=$(cpinfo -y fw1 2>/dev/null | grep -i 'fw1' | head -1)
if [ -z "$VERSION" ]; then
    VERSION=$(fw ver 2>/dev/null)
fi
echo "Installed version: $VERSION"

# Check Jumbo Hotfix take
JUMBO_TAKE=$(cpinfo -y fw1 2>/dev/null | grep -i 'jumbo' | grep -oP 'Take \K[0-9]+')
if [ -z "$JUMBO_TAKE" ]; then
    JUMBO_TAKE=$(installed_jumbo_take 2>/dev/null)
fi
echo "Jumbo Hotfix Take: ${JUMBO_TAKE:-not detected}"

# Check for sk185222 hotfix specifically
if cpinfo -y fw1 2>/dev/null | grep -qi 'sk185222'; then
    echo "RESULT: PATCHED - sk185222 hotfix detected."
    exit 0
fi

# Check Trusted Clients configuration as compensating control
TRUSTED=$(grep -c 'any' /opt/CPshrd-*/conf/sic_policy.conf 2>/dev/null || echo "unknown")
if [ "$TRUSTED" != "unknown" ] && [ "$TRUSTED" -gt 0 ]; then
    echo "WARNING: Trusted Clients appears to include 'any' - management ports may be widely accessible."
fi

# If we cannot confirm patch, assume vulnerable
echo "RESULT: VULNERABLE - sk185222 hotfix not detected. Apply hotfix from Check Point support portal."
exit 1

Sources

1. Check Point sk185222 — CVE-2026-18574 Advisory
2. Rapid7 — CVE-2026-16232 SmartConsole Authentication Bypass (ETR)
3. Rapid7 — CVE-2026-16232 Technical Analysis
4. The Hacker News — Check Point SmartConsole Flaw Exploited
5. Check Point Blog — July 2026 Security Advisory
6. Check Point sk185169 — CVE-2026-16232 Advisory
7. Help Net Security — Check Point Management Takeover
8. CheckMates Forum — Management Ports Exposed Discussion