An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security…

CVE-2026-18574 is an authentication bypass (CWE-288) in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) that allows an unauthenticated remote attacker with network access to management services to execute arbitrary commands. The flaw spans a massive version range: R80, R80.10, R80.20, R80.30, R80.40, R81, R81.10, R81.20, R82, and R82.10. Patches exist only for R81.20+, meaning the R80.x and early R81.x branches (all end-of-support) have no fix. Check Point discovered it internally and published it on 2026-08-03 with a CVSS 4.0 score of 9.3 CRITICAL.

The vendor severity of 9.3 is honest and, if anything, could be *understated* for shops that haven't segmented their SMS. This is not a theoretical policy-read or info-leak — it's full command execution on the box that authors every firewall rule, holds every gateway SIC certificate, and stores administrator credentials. The only friction is network reachability to ports 18190/19009, which is restricted in well-segmented environments but trivially reachable from any host on the management VLAN or through misconfigured implied rules. The blast radius — rewriting firewall policy across every managed gateway — is fleet-scale by definition.

Why this verdict

• Unauthenticated RCE, zero complexity: CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N — the lowest possible attacker effort once network access is achieved. No credential theft, no phishing, no user interaction required.
• Role multiplier — SMS is the fleet's firewall brain: Check Point SMS is not a workstation or app server. It is the *sole* policy authority for every managed gateway. 100% of SMS installations occupy the high-value network-management-plane role by definition. Compromise yields: policy rewrite across all gateways, SIC certificate extraction, admin credential theft, VPN PSK exfiltration. Blast radius: fleet-scale.
• Enormous version surface with EoS gaps: Every Gaia release from R80 through R82.10 is affected. R80.x and R81/R81.10 are end-of-support with no patch available, forcing a major upgrade or compensating controls. Organizations running EoS versions cannot simply apply a hotfix.
• Adjacent CVE-2026-16232 PoC lowers the weaponization bar: A public PoC already exists for the related SmartConsole auth bypass (CVE-2026-16232, Rapid7). Researchers familiar with Check Point's SIC/CPMI internals are likely to produce a CVE-2026-18574 PoC rapidly.

Why not higher?

A 9.3 is already near-ceiling. The only reason this is not a 10.0 is that the CVSS 4.0 vector shows SC:N/SI:N/SA:N (no subsequent-system impact beyond the SMS itself in the formal model), and the vendor reports no active exploitation. In practice, the SMS *does* control subsequent systems (gateways), but the formal scoring reflects direct impact only.

Why not lower?

Despite management VLAN segmentation providing friction, the SMS is *canonically* a high-value-role component — 100% of installations are the firewall management plane. The unauthenticated, zero-complexity attack chain means any internal attacker (or any host compromised via phishing, VPN, or another CVE) that can route to the SMS can exploit this. Network segmentation is a compensating control, not a design guarantee — implied rules regularly break it. The CRITICAL floor applies and cannot be overridden by generic 'requires internal access' friction alone.

1. Lock down Trusted Clients to explicit admin IPs immediately — In SmartConsole → Global Properties → Management Access → Trusted Clients, restrict GUI client access to a named list of administrator workstation IPs. This is the single highest-ROI control — it eliminates the network-reachability prerequisite for most internal attackers. Deploy within 3 days per noisgate mitigation SLA for CRITICAL.
2. Block management ports at the network layer — Add explicit ACLs on switches/firewalls upstream of the SMS to permit TCP 18190, 19009, and 18264 only from the management jump host subnet. Do not rely on Check Point implied rules alone. Deploy within 3 days.
3. Isolate SMS on a dedicated management VLAN with MFA jump host — If not already segmented, place the SMS on a VLAN reachable only through an MFA-gated jump host. This adds an authentication barrier the CVE cannot bypass. Deploy within 3 days for CRITICAL.
4. Enable and forward SMS audit logs to external SIEM — Forward /var/log/messages, SmartConsole audit logs, and cpd daemon logs to an external SIEM. Create alerts for: unexpected SmartConsole logins, policy installations outside change windows, and mgmt_cli commands from non-admin source IPs. This provides detection-in-depth.
5. Upgrade EoS versions (R80.x, R81, R81.10) immediately — These versions have no patch. The only remediation is upgrading to R81.20+ and applying the Jumbo Hotfix. Treat this as an emergency migration — begin planning within 3 days, execute within 90 days per noisgate remediation SLA.

Run this script on the Check Point SMS/MDS appliance itself as the admin user in Expert mode (expert shell). Invoke with: bash check_cve_2026_18574.sh. Requires Expert mode access to read cpinfo and installed hotfix data.

#!/bin/bash
# check_cve_2026_18574.sh
# Checks if Check Point SMS/MDS is patched for CVE-2026-18574
# Run on the SMS/MDS appliance in Expert mode
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

echo "=== CVE-2026-18574 Check ==="
echo "Date: $(date)"
echo "Hostname: $(hostname)"

# Get Gaia version
if command -v clish &>/dev/null; then
    VERSION=$(clish -c 'show version product' 2>/dev/null | grep -oP 'R[0-9]+\.?[0-9]*' | head -1)
else
    VERSION=$(cat /etc/cp-release 2>/dev/null | grep -oP 'R[0-9]+\.?[0-9]*' | head -1)
fi

if [ -z "$VERSION" ]; then
    echo "UNKNOWN - Could not determine Gaia version."
    exit 2
fi
echo "Detected version: $VERSION"

# Get installed Jumbo Take
JUMBO_TAKE=$(cpinfo -y fw1 2>/dev/null | grep -i 'jumbo' | grep -oP 'Take [0-9]+' | grep -oP '[0-9]+' | tail -1)
if [ -z "$JUMBO_TAKE" ]; then
    JUMBO_TAKE=0
fi
echo "Installed Jumbo Take: $JUMBO_TAKE"

case "$VERSION" in
    R82.10)
        REQUIRED=404040
        ;;
    R82)
        REQUIRED=122122122
        ;;
    R81.20)
        REQUIRED=161161161
        ;;
    R81.10|R81|R80.40|R80.30|R80.20|R80.10|R80)
        echo "VULNERABLE - $VERSION is end-of-support with NO available patch for CVE-2026-18574."
        echo "Action: Upgrade to R81.20+ and apply the required Jumbo Hotfix."
        exit 1
        ;;
    *)
        echo "UNKNOWN - Unrecognized version: $VERSION"
        exit 2
        ;;
esac

if [ "$JUMBO_TAKE" -ge "$REQUIRED" ]; then
    echo "PATCHED - $VERSION Take $JUMBO_TAKE meets or exceeds required Take $REQUIRED."
    exit 0
else
    echo "VULNERABLE - $VERSION Take $JUMBO_TAKE is below required Take $REQUIRED."
    echo "Action: Apply Jumbo Hotfix Accumulator Take $REQUIRED or later."
    exit 1
fi

Sources

1. Check Point Advisory sk185222
2. NVD - CVE-2026-18574
3. CybersecurityNews - Check Point Auth Bypass
4. GBHackers - Critical Check Point Flaw
5. Rapid7 - CVE-2026-16232 Technical Analysis
6. CheckMates - Management Ports Exposed
7. CVE.org - CVE-2026-18574