NCSC-2026-0264 [1.00] [M/H] Vulnerabilities fixed in Check Point Security Management products

Check Point has fixed vulnerabilities in SmartConsole, Gaia Portal, Security Management, and Multi-Domain Security Management. The vulnerabilities involve authentication bypasses and privilege escalations within various Check Point management components. - In SmartConsole, unauthenticated external attackers can obtain administrative login tokens, granting them full administrative access and the ability to modify security policies. This vulnerability requires internet access to the Management Server and a permissive Trusted Clients configuration. - In Gaia Portal, an authenticated user with read-only rights can execute commands with root privileges, bypassing access protection. - In Security Management and Multi-Domain Security Management, unauthenticated external attackers with network access to the Management Server can execute administrative commands, potentially leading to control over managed Security Gateways, depending on firewall and Trusted Client settings. Check Point reports that active exploitation of the vulnerability identified by CVE-2026-16232 has been observed among a limited number of users who had incorrectly configured the vulnerable tooling and made it publicly available on the internet. These users have already been informed. No further exploitation has been observed at this time. The mentioned applications are not intended to be publicly accessible without additional measures but should be supported in a separate environment. Publicly accessible systems are particularly at high risk of active exploitation.