This vulnerability (CWE-287) in Check Point Quantum Security Management products permits an unauthenticated remote attacker to bypass authentication controls and execute administrative commands on the Management Server. Additionally, the attacker may execute commands on managed Security Gateways. The attack vector requires network access to the Management Server, which must be exposed without firewall protection or have a misconfiguration that does not restrict Trusted Clients. The CVSS v3.1 base score is 9.1, reflecting high impact on confidentiality and integrity with no user interaction or privileges required.

An attacker exploiting this vulnerability can gain administrative control over the Management Server, potentially leading to full compromise of the security management infrastructure. This includes executing arbitrary commands on the Management Server and on managed Security Gateways, severely impacting confidentiality and integrity of the protected network environment. Availability impact is not indicated. The vulnerability requires network access to the Management Server without adequate firewall or Trusted Clients restrictions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, ensure that the Management Server is not accessible from untrusted networks and that firewall rules and Trusted Clients configurations strictly limit network access. Monitor vendor communications for updates and apply patches promptly once released.