Loading story…
Check Point released fixes for CVE-2026-18574, a critical authentication-bypass flaw in Security Management Server and Multi-Domain Security Management Server (MDS) that can let an unauthenticated remote attacker with network access to management services execute arbitrary commands. The vulnerability carries a CVSS 4.0 score of 9.3 and is classified as CWE-288, with impact that can extend to full compromise of the security management environment.
Check Point said it discovered the issue internally and reported no evidence of active exploitation, while noting that Smart-1 Cloud customers are already protected. Supported affected versions include R81.20, R82, and R82.10, with older affected releases from R80 through R81.10 now end-of-support; fixes were issued through Jumbo Hotfix Accumulator updates. The company urged customers to apply patches, restrict Trusted Clients, limit management access to trusted administrator systems, avoid exposing management interfaces to untrusted networks or the public internet, and monitor for unauthorized activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The CVE record for CVE-2026-18574 was published, classifying the issue as a critical remotely exploitable authentication bypass with a CVSS 4.0 score of 9.3. Check Point stated it had no indication of active exploitation.
Check Point addressed CVE-2026-18574 through Jumbo Hotfix Accumulator updates for supported versions including R81.20, R82, and R82.10. It also said Smart-1 Cloud customers were already protected and advised customers to restrict management access and apply patches.
Check Point said it discovered CVE-2026-18574 internally. The flaw is an authentication bypass in Security Management Server and Multi-Domain Security Management Server that can enable unauthenticated remote command execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecert.pa
Open sourcecyber.gc.ca
Open sourceacn.gov.it
Open sourcecybersecuritynews.com
Open sourcecvefeed.io
Open sourcecvereports.com
Open sourcecert.gov.py
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point disclosed **`CVE-2026-16232`**, a high-severity SmartConsole authentication bypass affecting **Security Management**, **Multi-Domain Management**, **Firewall**, and **Multi-Domain Log Server** products across multiple versions. The flaw, rated **CVSS 9.3**, allows attackers to bypass SmartConsole login using an application token, and Check Point said it has already been exploited against a small number of customers with specific exposed configurations. Check Point released fixes for `CVE-2026-16232` along with related flaws **`CVE-2026-62144`** and **`CVE-2026-62145`**, while the Canadian Centre for Cyber Security issued advisory **AV26-735** urging organizations to review the vendor guidance and apply mitigations. The highest risk is for management interfaces exposed directly to the internet without IP restrictions, and defenders were advised to install the available jumbo hotfix, restrict trusted GUI clients by IP address, and place management access behind a firewall until patching is complete.
Jul 30, 2026
CISA added **CVE-2026-16232** to its Known Exploited Vulnerabilities catalog after reports of active exploitation against **Check Point SmartConsole**. The flaw, mapped to **`CWE-287` Improper Authentication**, affects Check Point Quantum Security Management and Multi-Domain Security Management and allows an unauthenticated remote attacker to obtain an application login token and authenticate with **full administrative privileges**. Check Point said the issue has affected a very small number of customers, while CISA set a **2026-07-25** remediation deadline under **BOD 26-04** and directed organizations to apply vendor mitigations and conduct forensics triage. Successful exploitation can let attackers modify security policies and configurations, and remote attacks are possible when the Management Server is reachable and Trusted Clients restrictions are not in place. CISA’s broader KEV update also added **CVE-2026-50522** affecting Microsoft SharePoint, bringing the catalog total to 1,653 entries.
Jul 23, 2026
Check Point released security updates to fix multiple vulnerabilities across **Mobile Access**, **SSL VPN**, **Remote Access VPN**, **Spark Firewall**, **Security Gateways**, and **Multi-Domain Security Management**. The most severe flaw, **`CVE-2026-50751`** with a **CVSS 9.3**, is an authentication bypass issue in deprecated **IKEv1** key exchange used for VPN Remote Access and Mobile Access, and Check Point said it is being exploited in the wild as a **zero-day**. The update also addresses **`CVE-2026-50752`**, which affects certificate validation in deprecated **IKEv1** site-to-site VPN connections and could allow **man-in-the-middle** attacks. Across the broader set of flaws, Check Point warned of risks including **denial of service, data manipulation, authentication bypass, and unauthorized access**, and urged organizations to apply patches as soon as testing is complete.
Jul 10, 2026