Latest Check Point vulnerabilities: CVE-2026-16232, CVE-2026-62144, and CVE-2026-62145 #
Check Point disclosed in three advisories that certain versions their products are affected by multiple vulnerabilities:
- CVE-2026-16232: An authentication bypass vulnerability in the SmartConsole login process that allows a remote, unauthenticated attacker to obtain an application login token and authenticate with full administrative privileges. To exploit this, the attacker must have network access to the management interface, and the system must lack Trusted Clients (GUI clients) restrictions. Successful exploitation permits full modification of security policies and configurations. The vulnerability has been designated CVE-2026-16232 and has been rated critical with a CVSS score of 9.1.
- CVE-2026-62144: An authentication bypass vulnerability in the Security Management and Multi-Domain Security Management servers that allows a remote, unauthenticated attacker to execute administrative commands on the server, including run-script and exec-command on managed Security Gateways. The attacker must have access to the management interface, and the system must lack firewall protections or Trusted Clients restrictions. The vulnerability has been designated CVE-2026-62144 and has been rated critical with a CVSS score of 9.1.
- CVE-2026-62145: A local privilege escalation vulnerability in the Gaia Portal that allows an authenticated, low-privileged (read-only) attacker to execute arbitrary commands with root privileges. The vulnerability has been designated CVE-2026-62145 and has been rated high with a CVSS score of 7.5.
There is evidence that CVE-2026-16232 is being actively exploited in the wild, prompting its addition to the CISA KEV catalog on July 22, 2026
The following versions are affected
- Security Management Server, Multi-Domain Security Management Server (MDS), Security Gateways: R81.20, R82, R82.10, and End-of-Support (EOS) versions R77.30 through R81.10.
Note: Spark Gateways are not affected.
What are Check Point Security Gateways, Security Management Server, SmartConsole, and Multi-Domain Security Management? #
Check Point Security Gateways act as physical or virtual enforcement points that inspect network traffic and execute access rules in real time. The Security Management Server serves as the centralized database and control plane that stores configuration settings, processes logs, and compiles security policies to deploy to those gateways. SmartConsole is the graphical interface, available as a Windows client or web application, that administrators use to configure policies, manage network objects, and monitor system health. Multi-Domain Security Management (MDS) extends this architecture by hosting multiple, isolated virtual management servers on a single platform to serve complex multi-tenant or enterprise environments.
What is the impact? #
Successful exploitation of these vulnerabilities would allow an attacker to bypass authentication to gain full administrative control over management servers, execute arbitrary commands on managed firewalls, and escalate local privileges to root.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible:
- R82.10: Upgrade to Jumbo Hotfix Accumulator Take 36 or later.
- R82: Upgrade to Jumbo Hotfix Accumulator Take 118 or later.
- R81.20: Upgrade to Jumbo Hotfix Accumulator Take 158 or later.
- End-of-Support (EOS) Releases (R81.10, R81, R80.40, R80.30, R80.20, R80.10, R80, and R77.30): No hotfix specified. Upgrade to a supported release or apply vendor mitigations.
Mitigation:
- Restrict Trusted Clients (GUI clients) access strictly to trusted IP addresses or subnets.
- Protect management interfaces with a firewall and restrict access exclusively to authorized IP addresses.
How to find potentially vulnerable systems with runZero #
From the Asset Inventory, use the following query to locate potentially impacted assets:
os:="Check Point Gaia"June 2026: CVE-2026-50751 #
Check Point disclosed that certain versions of their VPN products utilize the deprecated IKE protocol version 1 (IKEv1) that are affected by an authentication logic flow vulnerability. Remote unauthenticated attackers can utilize this vulnerability to bypass the authentication validation without credentials in order to gain access to secure networks. This vulnerability has been designated CVE-2026-50751 and has been rated critical with a CVSS score of 9.3.
The following versions are affected:
- Security Gateways:
- R82.10 Jumbo Hotfix Take 19 or below
- R82 Jumbo Hotfix Take 103 or below
- R81.20 Jumbo Hotfix Take 141 or below
- R81.10 (End-of-Support (EOS))
- R81 (End-of-Support (EOS))
- R80.40 (End-of-Support (EOS))
- Spark Firewalls:
- R80.20.X (End-of-Support (EOS))
- R82.00.X
- R81.10.X
What is Check Point Remote Access and Mobile Access VPN? #
Check Point Remote Access and Mobile Access VPN provide users access to corporate networks over IPSec.
What is the impact? #
Successful exploitation of the vulnerability would allow an attacker to establish an unauthorized VPN connection and gain access to protected networks.
Are updates or workarounds available? #
Users are encouraged upgrade affected systems to the following versions:
Security Gateway, Maestro Orchestrator, and Security Group
- R82.10 Jumbo Hotfix Accumulator Take 19 (Take #3)
- R82.10 Jumbo Hotfix Accumulator Take 6 (Take #2)
- R82 Jumbo Hotfix Accumulator Take 103 (Take #2)
- R82 Jumbo Hotfix Accumulator Take 91 (Take #2)
- R81.20 Jumbo Hotfix Accumulator Take 141 (Take #2)
- R81.20 Jumbo Hotfix Accumulator Take 127 (Take #2)
- R81.20 Jumbo Hotfix Accumulator Take 120 (Take #2)
- R81.20 Jumbo Hotfix Accumulator Take 113 (Take #2)
Spark Firewall Appliances
- R82.00.10 Build 998002216
For End-of-Support products Check Point has provided multiple mitigation options.
How to find potentially vulnerable systems with runZero #
From the Service inventory, use the following query to locate potentially impacted assets:
hw:="Check Point%" AND protocol:ike AND ike.version:="1.0"May 2024: CVE-2024-24919 #
On May 28, 2024, Check Point disclosed a serious vulnerability in Check Point Security Gateway Devices with certain remote access software blades (security modules) enabled. Per their guidance, devices are impacted if one of the following conditions are met:
- The IPsec VPN Blade is enabled, but ONLY when included in the Remote Access VPN community.
- The Mobile Access Software Blade is enabled.
The issue, identified as CVE-2024-24919, allows reading arbitrary files on the targeted appliance by unauthenticated remote attackers. This vulnerability could be leveraged to read sensitive files such as those containing password hashes, certificates, and ssh keys.
This vulnerability has a CVSS score of 8.6 out of 10, indicating that this is a high risk vulnerability. According to their disclosure and information provided by CISA this vulnerability is being actively exploited. A report from mnemonic.io states that they have observed attacks at least as far back as April 30, 2024.
What is the impact? #
Upon successful exploitation of the vulnerability, unauthenticated remote attackers could access password hashes for local users. If the hashes are cracked the attacker may be able to log into these user accounts if secondary controls, such as MFA, are not enforced. This includes service accounts that may be used to access Active Directory or other services. Attackers could leverage this information to move across a target's network.
Are updates or workarounds available? #
Check Point has released a software updates to address this vulnerability. They also provide guidance for other measures that should be taken after the vulnerability has been addressed. These can be found in their advisory.
How do I find potentially vulnerable Check Point devices with runZero? #
From the Asset Inventory, use the following query to locate assets that may be running the vulnerable operating system in your network:
hardware:"Check Point" AND (_service.last.http.body:"Check Point Mobile" OR _service.http.body:"Check Point Mobile" OR udp_port:500)
