Check Point Security Management Vulnerabilities & Security Advisories
11 advisories tracked · Check Point ([email protected] CNA) via NVD · 2 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Check Point advisory that VulniPulse classified as Security Management, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 6 critical, 2 high, 3 medium.
Android app · Google Play
Monitor Check Point CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Source
Check Point ([email protected] CNA) via NVD
Check Point is its own CVE Numbering Authority. VulniPulse ingests Check Point's CVEs from the NVD CNA feed ([email protected]), each linking to its support.checkpoint.com advisory. Covers Quantum Security Gateway / Spark, the Gaia OS, Quantum Maestro, Harmony Endpoint / Mobile, CloudGuard and the Security Management server — its Quantum VPN/gateways were mass-exploited (CVE-2024-24919), a top network-security target.
Latest Check Point Security Management advisories
Critical [CVE-2026-93616] directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server
A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server. Affected products named by the advisory: Quantum Security Management; Multi-Domain Security Management Server.
Critical [CVE-2026-91843] Stack overflow in login process to the Security Management and Log Servers
Issue: A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges. This issue received the ID CVE-2026-91843 and a CVSS score of 9.8. Affected Products: Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server. Note: The Smart-1 Cloud environment is not affected because the fix has already been implemented there. Affected Versions: R82.20 R82.10 Jumbo Hotfix Take 44 or lower R82 Jumbo Hotfix Take 126 or lower R81.20 Jumbo Hotfix Take 166 or lower R81.10 Jumbo Hotfix Take 190 or lower (EoS) R80, R80.10, R80.20, R80.30, R80.40, R81 (all EoS) How to identify an attackIn SmartConsole, search for Audit and Admin login logs containing the message: "Administrator failed to log in: Username too long".Mitigation Follow the Check Point Gateway and Management Hardening Administration Guide. Limit Trusted Clients (GUI clients) to trusted IP addresses/subnets. To do so, In SmartConsole, go to Manage & Settings > Permissions & Administrators > Trusted Clients. Double-click the client you want to edit. In the Trusted Client configuration window that opens, change the settings as needed. Make sure do not to use "Any" as a Client Type. Affected products named by the advisory: Quantum Security Management.
Critical [CVE-2026-85103] heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems
A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems. Affected products named by the advisory: Security Management Server; Spark Firewall (Locally Managed); Spark Firewall (Centrally Managed).
Critical [CVE-2026-18574] authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server
An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system. Check Point discovered this issue internally and has no indication of active exploitation.
Critical [CVE-2026-62144] authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security Gateways. Exploitation requires network access to the Management Server without firewall protection or a configuration that does not restrict Trusted Clients. Affected products named by the advisory: Quantum Security Management.
Critical [CVE-2026-16232] authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers. Affected products named by the advisory: Quantum Security Management; Multi-Domain Security Management.
High [CVE-2026-62145] vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges
A vulnerability in Check Point Gaia Portal allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges. Affected products named by the advisory: Quantum Security Gateway; Quantum Security Management; Security Gateways.
Medium [CVE-2026-48136] When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can modify stored metadata associated with Compliance Best Practices in another Management Domain, where the administrator has no access permissions, bypassing Role-Based Access Control (RBAC)
When Compliance is enabled on Check Point Multi-Domain Management, an authenticated administrator with read-write access to one Management Domain (CMA) can modify stored metadata associated with Compliance Best Practices in another Management Domain, where the administrator has no access permissions, bypassing Role-Based Access Control (RBAC).The issue affects: R82.10 with Jumbo Hotfix Take 6 or below R82 with Jumbo Hotfix Take 91 or below R81.20 with Jumbo Hotfix Take 127 or below All releases from R81.10 and below This issue received the ID CVE-2026-48136. Affected products named by the advisory: Multi-Domain Security Management Server.
Medium [CVE-2024-24915] SmartConsole: Credentials are not cleared from memory after being used.
Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole process and fetch them.
Medium [CVE-2024-24911] In rare scenarios, the cpca process on the Security Management Server / Domain Management Server
In rare scenarios, the cpca process on the Security Management Server / Domain Management Server may exit unexpectedly, creating a core dump file. When the cpca process is down, VPN and SIC connectivity issues may occur if the CRL is not present in the Security Gateway's CRL cache.
High [CVE-2020-6024] Check Point SmartConsole before R80.10 Build 185, R80.20 Build 119, R80.30 before Build 94, R80.40 before Build 415, and R81…
Check Point SmartConsole before R80.10 Build 185, R80.20 Build 119, R80.30 before Build 94, R80.40 before Build 415, and R81 before Build 548 were vulnerable to a possible local privilege escalation due to running executables from a directory with write access to all authenticated users.