Check Point Critical Auth Bypass Flaw CVE-2024-24934 Exposes Security Management Systems

Key Takeaways

• Check Point has released critical patches for a high-severity authentication bypass vulnerability, CVE-2026-18574.
• The flaw impacts both Security Management Server and Multi-Domain Security Management Server deployments across various Check Point releases.
• Successful exploitation could grant an unauthenticated attacker complete control over the Security Management system, potentially compromising firewall policies and the entire managed security infrastructure.
• While there’s no evidence of active exploitation, immediate patching is crucial, especially for supported versions R81.20, R82, and R82.10.
• Organizations are advised to restrict management access to trusted clients and upgrade unsupported systems.

Critical Authentication Bypass Threatens Check Point Security Management Systems

Check Point has issued urgent security updates to address a critical authentication bypass vulnerability, identified as CVE-2026-18574. This high-severity flaw poses a significant risk, potentially allowing unauthorized attackers to fully compromise vulnerable Security Management environments.

The vulnerability affects both standalone Security Management Server and Multi-Domain Security Management Server installations across multiple Check Point product versions. An unauthenticated attacker, with network access to the targeted management server, could exploit this flaw to bypass authentication mechanisms and execute arbitrary commands.

Should an attack succeed, the consequences are severe. A complete takeover of the Security Management system could occur, leading to unauthorized modifications of firewall policies, gateway configurations, administrator access credentials, and the entire managed security infrastructure.

Affected Versions and Remediation

The vulnerability impacts a broad range of Check Point versions, including R80, R80.10, R80.20, R80.30, R80.40, R81, and R81.10. It is important to note that all these versions have reached their end-of-support status. Crucially, supported affected versions include R81.20, R82, and R82.10.

Check Point has confirmed that its Smart-1 Cloud customers are already protected from this issue. The company stated that it discovered CVE-2026-18574 internally and has not found any evidence of active exploitation in the wild. Despite the lack of in-the-wild attacks, the potential impact necessitates immediate action, as these Security Management Servers typically hold highly privileged access to an organization’s firewall configurations and security policy controls. Exploitation of this vulnerability requires direct network connectivity to the Check Point Security Management Server.

Organizations face elevated risks if they do not strictly define Trusted Clients, permit GUI client connections from broad network ranges, or expose management services to untrusted networks. Best practice dictates that management interfaces should never be directly accessible from the public internet or unrestricted user networks.

Check Point has addressed the flaw through specific Jumbo Hotfix Accumulator updates. The necessary fixes are available in Jumbo Hotfix Accumulator Take 404040 for R82.10, Take 122122122 for R82, and Take 161161161 for R81.20.

Organizations still utilizing unsupported R80 and earlier R81 versions are strongly advised to prioritize upgrading to a supported release, as patches for these end-of-support versions may not be available.

What You Should Do

• Apply Patches Immediately: For supported versions (R81.20, R82, R82.10), deploy the relevant Jumbo Hotfix Accumulator updates as soon as possible.
• Restrict Trusted Clients: Configure SmartConsole to restrict Trusted Clients to only approved administrative IP addresses and subnets. Avoid using “Any” as a Trusted Client definition.
• Upgrade Unsupported Systems: If you are running end-of-support versions (R80 and early R81), prioritize upgrading to a currently supported release to ensure patch availability and ongoing security.
• Limit Management Connectivity: Ensure that management connectivity is strictly limited to dedicated, trusted administrator workstations and internal, secure networks.
• Review Firewall Policies: Verify that firewall policies explicitly restrict management access, ensure implied rules protecting control connections remain enabled, and prevent Management services from being exposed to untrusted external networks.
• Monitor Logs: Regularly review logs for any unusual management connections, unexpected administrator activity, or suspicious command execution attempts, which could indicate a compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.