This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Check Point fixes 3 vulnerabilities, 1 of them actively exploited

Check Point fixes three vulnerabilities in Security Management, Multi-Domain Security Management and Security Gateway, two of which are critical [1]. Vulnerability CVE-2026-16232 is being actively exploited and has therefore been added to the CISA KEV catalog [2]. A list of observed IoCs (IP addresses) can be found at [1][3]. Fixes are available as part of the Jumbo Hotfix Accumulator [3][4][5]: - for R82.10 from Take 36 [6] - for R82 from Take 118 [7] - for R81.20 from Take 158 [8] If an immediate update to a fixed version is not possible, the risk can be temporarily mitigated according to the procedures at [3][4][5].

Check Point Security Management & Multi-Domain Security Management Server - authentication bypass (CVE-2026-16232)
CVSS 9.1 (Critical)

An unauthenticated remote attacker can obtain an application login token in Security Management and Multi-Domain Security Management Server, log in to SmartConsole with full administrator privileges and modify security policies and configuration [3][9]. The vulnerability is exploitable if the Management server is accessible from the Internet without restriction to Trusted Clients (GUI clients) [3].

The vulnerability is present in products:

  • Security Management Server; ==R77.30; ==R80; ==R80.10; ==R80.20; ==R80.30; ==R81; ==R81.10; ==R81.20; ==R82; ==R82.10;
  • Multi-Domain Security Management Server; ==R77.30; ==R80; ==R80.10; ==R80.20; ==R80.30; ==R81; ==R81.10; ==R81.20; ==R82; ==R82.10;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 22. 7. 2026.

Check Point Security Management & Multi-Domain Security Management Server - authentication bypass (CVE-2026-62144)
CVSS 9.1 (Critical)

An unauthenticated remote attacker can execute arbitrary commands on Security Management and Multi-Domain Security Management Server, including run-script and exec-command on managed Security Gateways [4][11]. The vulnerability is exploitable if access to the server is not protected by a firewall or not restricted to Trusted Clients (GUI clients) [4][10].

The vulnerability is present in products:

  • Security Management Server; ==R77.30; ==R80; ==R80.10; ==R80.20; ==R80.30; ==R81; ==R81.10; ==R81.20; ==R82; ==R82.10;
  • Multi-Domain Security Management Server; ==R77.30; ==R80; ==R80.10; ==R80.20; ==R80.30; ==R81; ==R81.10; ==R81.20; ==R82; ==R82.10;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 22. 7. 2026.

Check Point Security Management & Multi-Domain Security Management - LPE (CVE-2026-62145)
CVSS 7.5 (High)

An authenticated remote attacker with read-only access to Gaia Portal on Security Gateway and Security Management can execute commands with root privileges [11][5]. The vulnerability does not affect Check Point Spark Gateway [11].

The vulnerability is present in products:

  • Security Gateway; ==R77.30; ==R80; ==R80.10; ==R80.20; ==R80.30; ==R81; ==R81.10; ==R81.20; ==R82; ==R82.10;
  • Security Management; ==R77.30; ==R80; ==R80.10; ==R80.20; ==R80.30; ==R81; ==R81.10; ==R81.20; ==R82; ==R82.10;

CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

By CESNET, z.s.p.o. Michaela Ručková on 23. 7. 2026.

CESNET, z.s.p.o. Logo