Check Point has released security updates to address a critical authentication bypass vulnerability, identified as CVE-2026-18574, affecting its Security Management Server and Multi-Domain Security Management Server deployments. This flaw could allow unauthenticated attackers with network access to execute arbitrary commands, potentially leading to a complete system takeover.
The vulnerability impacts several versions, including R80, R80.10, R80.20, R80.30, R80.40, R81, and R81.10, all of which have reached their end of support. Supported versions affected are R81.20, R82, and R82.10. Check Point has confirmed that Smart-1 Cloud customers are already protected from this issue.
Exploitation of this vulnerability requires network connectivity to the Security Management Server. Organizations are at increased risk if they do not restrict Trusted Clients, allow GUI client connections from broad network ranges, or expose management services to untrusted networks. Management interfaces should never be directly accessible from the public internet or unrestricted user networks.
Check Point has addressed the flaw through Jumbo Hotfix Accumulator updates. The fixes are available in Jumbo Hotfix Accumulator Take 404040 for R82.10, Take 122122122 for R82, and Take 161161161 for R81.20. Organizations using unsupported R80 and early R81 versions should prioritize upgrading to a supported release, as patches may not be available for these end-of-support versions.
Until patches can be deployed, Check Point recommends restricting Trusted Clients in SmartConsole to approved administrative IP addresses and subnets. Administrators should avoid using “Any” as a Trusted Client definition, install the updated security policy after making changes, and limit Management connectivity to dedicated trusted administrator workstations.
Security teams should also ensure that firewall policies restrict management access, implied rules protecting control connections remain enabled, and Management services are not exposed to untrusted networks. Reviewing logs for unusual management connections, unexpected administrator activity, or suspicious command execution can help detect potential compromise attempts.
Given the central role of the Security Management Server in controlling firewall policies and configurations, a compromise could have severe implications. Organizations should treat CVE-2026-18574 as a priority remediation issue and apply the relevant Check Point hotfix without delay.
This incident underscores the critical importance of timely patch management and network access controls in maintaining the security of enterprise environments. Organizations should regularly review and update their security policies to mitigate potential vulnerabilities.
