Critical severity · published Jul 22, 2026
CVE-2026-62144
Management Authentication Bypass and Privilege Escalation
9.1
CVSS
1%
EPSS
No
On KEV
Description
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security Gateways. Exploitation requires network access to the Management Server without firewall protection or a configuration that does not restrict Trusted Clients.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MS
Multi-Domain Security Management · checkpoint
R82.10 with Jumbo Hotfix Take 36 or below; R82 with Jumbo Hotfix Take 118 or below; R81.20 with Jumbo Hotfix Take 158 or below; R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30 · source: vendor
QS
Quantum Security Management · checkpoint
R82.10 with Jumbo Hotfix Take 36 or below; R82 with Jumbo Hotfix Take 118 or below; R81.20 with Jumbo Hotfix Take 158 or below; R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30 · source: vendor
Affected product
MS
Multi-Domain Security Management
checkpoint
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-62144
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-62144
support.checkpoint.com
https://support.checkpoint.com/results/sk/sk185152
More from Multi-Domain Security Management
9.8
CVE-2026-93616
Directory Traversal and File upload allows execution of arbitrary script on the Management Server
9.8
CVE-2026-16232
Authentication Bypass in the SmartConsole Login Process Using an Application Token
