Panama CSIRT Warns on Check Point CVE-2026-18574

CSIRT Panama published an advisory on the critical vulnerability CVE-2026-18574 in Check Point Security Management Server and Multi-Domain Security Management Server. The agency said there were no signs of active exploitation at the time of disclosure. Check Point said the same in its own advisory and described the issue as a management authentication bypass in those products.

What does CVE-2026-18574 allow?

The vulnerability allows an attacker to bypass management authentication and execute arbitrary commands on the affected system, according to CSIRT Panama. Check Point also said there were no signs of active exploits when it published its bulletin.

What did other CERTs say about CVE-2026-18574?

INCIBE-CERT issued an early warning about CVE-2026-18574 on August 3, describing it as a critical authentication vulnerability in Check Point Security Management Server and MDS that could allow remote execution of arbitrary commands. In that notice, the Spanish agency also said Check Point had no evidence of active exploitation.

Two days later, INCIBE-CERT expanded its coverage with an early warning about three critical vulnerabilities in VMware products. The agency said the impact included VMware ESX, vCenter, Workstation and Fusion, among other related platforms, and recommended applying VMware's patches from bulletin VMSA-2026-0006 immediately.

Outside Latin America, Moneycontrol reported that CERT-In issued a high-severity note on CVE-2026-18574 and stressed the need to install Check Point's security updates. That report widened the case's coverage beyond the region.