EPSS forecast — overtaken by confirmed exploitation
Exposure
Internet-facing
Exploitable remotely, no login, no user action
01
What's the risk?
An unauthenticated attacker, remotely over the network, with no user interaction, can fully compromise the system — steal data, tamper with it and take it offline.
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
How it's exploitedMITRE ATT&CK · inferred from weakness & vector
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
02
Who's exploiting it?
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Confirmed exploited in the wild.CISA KEV
Named threat actors and observed ATT&CK techniques appear here as intel feeds are folded in — the ATT&CK chain above stays inferred until then.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
!
Mitigate now
Immediately restrict network access to the Check Point Management Server IP address, ensuring it is not directly exposed to the internet. Implement strict firewall rules and VPN requirements for administrative access. Proactively monitor Management Server logs for any suspicious administrative login attempts or unauthorized configuration changes from untrusted sources.
✓
Permanent fix
Apply the vendor-provided hotfix or security update for Check Point SmartConsole and the Management Server immediately. Consult the official Check Point security advisory for specific hotfix numbers, affected product versions, and detailed installation instructions to permanently resolve this critical vulnerability.
Technical details— weakness, CVSS vector & calculator, related CVEs
Business impact
An unauthenticated remote attacker can exploit this flaw to obtain an application login token and gain full administrative privileges on the Check Point Management Server. This allows them to modify security policies and configurations, potentially leading to complete compromise of the network's security posture, unauthorized access, or denial of service.