{"uuid": "14fdbae9-44b1-4641-aab5-41c9e2d0417d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "name": "Check Point Blog - Security Advisory \u2013 Action Required \u2013 July 2026 Security Update", "description": "# Security Advisory - Action Required - July 2026 Security Update - Check Point Blog\nAs part of Check Point\u2019s Frontier AI Readiness Program, we are releasing a jumbo hotfix with security and hardening fixes for our firewall and management products.\n\nThis update includes a number of security hardening improvements and fixes, the most significant of which are outlined below.\n\nDuring a routine BLAST review, we discovered a few vulnerabilities. Following a thorough analysis, we identified one of those in the wild, affecting a handful of customers. This only affects a very specific configuration \u2014 when Management is exposed directly to the internet without IP restrictions. All affected customers have been notified. All Smart-1 Cloud customers are already protected.\n\nThis is exactly why programs like BLAST exist: to find and close gaps before they become real risks. We\u2019ll keep pushing the technological frontier, so organizations stay protected against what\u2019s coming next. It\u2019s proof of our ongoing commitment to the highest level of product security, and to keeping our customers protected.\n\nWe encourage all customers to install the jumbo hotfix and follow our published security best practices.\n\n\n\n* CVE: CVE-2026-16232\n  * Description: Authentication bypass with SmartConsole login using application token \u2013 Management\n  * CVSS: 9.3\n  * Affected Products: Security Management, Multi-Domain Management\n  * Affected Versions: R81.10, R81.20, R82, R82.10 (older versions impacted as well)\n  * In the Wild: Yes, for a handful of customers with specific configurations.\n  * SK:                                     sk185169                            \n* CVE: CVE-2026-62144\n  * Description: Management authentication bypass and privilege escalation\n  * CVSS: 9.3\n  * Affected Products: Security Management, Multi-Domain Management\n  * Affected Versions: R81.10, R81.20, R82, R82.10 (older versions impacted as well)\n  * In the Wild: No\n  * SK:                                     sk185152                            \n* CVE: CVE-2026-62145\n  * Description: Local privilege escalation in GaiaOS WebUI \u2013 Gateway\n  * CVSS: 7.5\n  * Affected Products: Firewall, Multi-Domain Management, Multi-Domain Log Server\n  * Affected Versions: R81.10, R81.20, R82, R82.10 (older versions impacted as well)\n  * In the Wild: No\n  * SK:                                     sk185153                            \n\n\nAdditional information can be found in the respective Secure Knowledge updates as linked below.\n\n### IoCs\n\nIP addresses observed:  \n151.241.99\\[.\\]207  \n151.241.99\\[.\\]233  \n158.62.198\\[.\\]182  \n192.142.10\\[.\\]99  \n139.28.37\\[.\\]250  \n194.213.18\\[.\\]137\n\n### Mitigation\n\nApply the following steps to mitigate the Management vulnerabilities:\n\n1.  Limit Trusted Clients (GUI clients) to trusted IP addresses/subnets.\n2.  Protect Management access with Firewall, restrict access to trusted IP addresses, and verify that implied rules for control connections are enabled.\n\n### Solution\n\nInstall the latest Jumbo hotfix released today (July 22, 2026).\n\n### Need support?\n\nIf you need help assessing your exposure, applying a mitigation, or installing the hotfix, please contact Check Point Support at:  \n[checkpoint.com/support-services/contact-support/](https://www.checkpoint.com/support-services/contact-support/)", "creation_timestamp": "2026-07-29T08:40:30.662153+00:00", "timestamp": "2026-07-29T08:40:30.662153+00:00", "related_vulnerabilities": ["CVE-2026-16232", "CVE-2026-62144", "CVE-2026-62145"], "author": {"login": "adulau", "name": "Alexandre Dulaunoy", "uuid": "c933734a-9be8-4142-889e-26e95c752803"}}