Summary
CVE-2026-62144 is a critical authentication bypass and privilege escalation vulnerability (CWE-287) in Check Point Quantum Security Management and Multi-Domain Security Management, carrying a CVSS v3.1 score of 9.1 (Critical). An unauthenticated remote attacker with network access to an exposed Management Server can execute arbitrary administrative commands on that server without any credentials or user interaction. Successful exploitation may further extend to command execution on managed Security Gateways, giving an attacker effective control over an organization’s entire firewall and security policy infrastructure.
Technical details
- Root cause: Improper authentication (CWE-287) in the management plane of Check Point Security Management and Multi-Domain Security Management allows the authentication process to be bypassed entirely by an unauthenticated attacker.
- Trigger conditions: The Management Server must be network-reachable without firewall protection, or configured without Trusted Client restrictions limiting which hosts may connect to management ports.
- Attack vector: Network-accessible (AV:N), no authentication required (PR:N), no user interaction needed (UI:N), low attack complexity (AC:L).
- Impact: An unauthenticated remote attacker can execute arbitrary administrative commands on the Security Management Server. Exploitation may further extend to command execution on all Security Gateways managed by the affected server, potentially enabling full compromise of an organization’s network security policies, firewall rules, and managed infrastructure.
Affected software
- Quantum Security Management and Multi-Domain Security Management:
- R82.10 — Jumbo Hotfix Take 36 or below
- R82 — Jumbo Hotfix Take 118 or below
- R81.20 — Jumbo Hotfix Take 158 or below
- R81.10, R81, R80.30, R80.20, R80.10, R80, R77.30 — all Jumbo Hotfix takes
Severity
CVSS v3.1 base score: 9.1 (Critical)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Mitigation and recommended actions
- Immediate patch: Check Point released updated Jumbo Hotfix takes on July 22, 2026. Apply the following minimum fixed versions per Check Point SK185152:
- R82.10: Jumbo Hotfix Take 37 or above
- R82: Jumbo Hotfix Take 119 or above
- R81.20: Jumbo Hotfix Take 159 or above
- R81.10 and older branches: apply the latest available Jumbo Hotfix as directed in SK185152
- Network mitigation: If immediate patching is not possible, restrict network access to the Management Server using firewall rules so that management ports are not reachable from untrusted networks. Configure Trusted Clients to explicitly allowlist only known administrative host IP addresses, preventing unauthenticated connections from arbitrary sources.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.