CVE-2026-62144

This is a security weakness in your Check Point management software that can let an attacker skip the login step. If the attacker can reach your Management Server over the network and your “Trusted Client” access is not tightly limited, they may be able to run powerful admin commands from the outside—like taking the keys to your security system’s control panel.

This matters if you run Check Point quantum security management or Check Point Multi-Domain Security Management and you have a Management Server that’s reachable over the network, especially from the internet. It also depends on whether your setup restricts “Trusted Clients”—if it does not, attackers have a clear path in. Treat it as a risk only when the attacker can reach the Management Server and your Trusted Client access controls don’t block unauthenticated remote attempts.

This is RED because exploitation has been reported as active in the wild, meaning attackers are using this weakness against real organizations. The flaw is remotely reachable without authentication when the Management Server is exposed and Trusted Client restrictions are insufficient, so exposure can translate directly into takeover of security management.

1. Confirm exposure (fast checks)

   • Identify the Check Point Management Server(s) running quantum security management and/or Multi-Domain Security Management.
   • Determine whether each Management Server has a public IP route and whether inbound access is allowed from the internet.
   • Confirm whether “Trusted Client” access is restricted to a small allowlist of approved management hosts (or equivalent vendor-controlled access restrictions).

2. Determine affected configuration posture

   • The findings state exploitation requires unauthenticated remote access and network conditions that allow the attack (for example, no firewall protection or an unrestricted Trusted Client configuration).
   • If you cannot prove that unauthenticated remote access is blocked and only approved trusted clients can connect, treat the system as exposed.

3. Contain immediately (workaround while waiting for fixes)

   • Block inbound connections to the Management Server from all internet sources.
   • Allow inbound management access only from your approved administrative network locations (specific IPs/hosts) and only over required ports.
   • Remove or lock down any configuration that permits broad Trusted Client connectivity.

4. Look for signs of compromise

   • Review management server logs for unexpected remote connections, authentication-bypass attempts, or admin-command activity from unknown IP addresses.
   • If your environment includes connected Security Gateways, check gateway-side logs for signs of unexpected command execution or configuration changes.

5. Patch/mitigation tracking

   • Our sources state that no fix/patch information is available yet for CVE-2026-62144. Ask your vendor/maintainer for:
     • The official fixed version(s) or mitigation guidance.
     • Whether interim emergency hardening steps should be applied.
   • CISA’s KEV remediation due date is July 25, 2026 (per the findings). Use this as your escalation deadline.

6. Verification after changes

   • Re-test reachability from unauthorized networks (or use an internal check from an untrusted source) to confirm the Management Server is no longer reachable from the internet and that Trusted Client access is limited.
   • Re-check logs after the change window to ensure no new suspicious activity occurs.

CVE-2026-62144 is a Critical authentication bypass (CWE-287) affecting Check Point quantum security management and Check Point Multi-Domain Security Management. The mechanism is an unauthenticated remote authentication bypass that enables remote command execution with administrative privileges against the Management Server; the findings also note the attacker may execute commands on connected Security Gateways. Reachability depends on network exposure of the Management Server and insufficient restriction of “Trusted Clients” or lack of firewall protection; the attack does not require user interaction. Exploitation status: exploitation has been reported as YES, with Check Point confirmation of active exploitation and CISA KEV catalog inclusion; KEV is not listed as a finding label in the provided KEV block, but the news block explicitly states it is in CISA KEV with a remediation due date of July 25, 2026. No public exploit code was found in the provided exploit findings, and no fix/patch information is available in the provided patch findings. EPSS is provided as low and flat in the source, but this should be treated as secondary to the confirmed active exploitation reported in the findings.