Check Point Security Management — unauthenticated command execution reaching mgmt server (CVE-2026-18574)

Ankit Mehta@Secvyn

•updated Aug 5, 2026•2•0•4

This rule detects potentially suspicious administrative activity on Check Point Security Management or Multi-Domain servers. It monitors the CommonSecurityLog for specific management-related activities ('command', 'cpm', 'cpca') originating from non-trusted IP ranges. This behavior is indicative of unauthorized management access or exploitation attempts targeting the administrative console of Check Point security appliances.