CVE-2026-16232 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-07-22

Added to CISA KEV: 2026-07-22 0 DAY BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review Management Server logs for unauthorized login attempts, unexpected policy changes, or unfamiliar administrator sessions
Immediately apply the vendor-provided Jumbo Hotfix Take updates referenced in sk185169 for all affected R77.30 through R82.10 versions
Restrict access to the Management Server/MDS to trusted IP ranges only; ensure 'Trusted Clients' configuration is properly enforced and does not allow unrestricted access
Remove any direct internet exposure of the Security Management Server/MDS interface; place behind VPN or restrict via firewall rules to management subnets only
Audit all administrator accounts and recent policy changes for signs of compromise following any period of exposure
Monitor SmartConsole authentication logs for anomalous token requests or logins from unexpected source IPs
Patch priority: CRITICAL/IMMEDIATE given active KEV exploitation and full administrative compromise impact

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-16232 is a critical authentication bypass vulnerability affecting the Check Point SmartConsole login process, specifically impacting Security Management Servers and Multi-Domain Security Management servers. By exploiting this flaw, an unauthenticated remote attacker can obtain an application login token to authenticate to the system with full administrative privileges, posing a severe risk to network security infrastructure managed by these platforms.

Exploitation

Active Exploitation: The vulnerability has been confirmed as exploited in the wild, leading to its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog ^[3].
PoC Availability: Proof-of-concept scripts and technical analysis are publicly available to assist in understanding and demonstrating the exploit vector ^[2].
Attack Prerequisites:

- The attack is remote and does not require local access. - No authentication is required to initiate the attack. - No specific user interaction is documented as a prerequisite for the exploit to succeed.

Affected Products & Patches

Affected Products: Check Point Security Management Server and Multi-Domain Security Management Server (MDS) utilizing the vulnerable SmartConsole login process ^[2].
Patches: Check Point has released security advisories and patches to address this vulnerability; organizations are strongly advised to apply the latest available security updates ^[1]^[4].
Mitigations: Until patches can be fully deployed, organizations can mitigate risk by configuring the SmartConsole login service to restrict access to trusted IP ranges or by placing the service behind a VPN tunnel to block unauthorized external access ^[1].

Impact

System Access: Successful exploitation grants an attacker full administrative privileges, allowing them to modify security policies, view sensitive network configurations, and potentially control managed firewall infrastructure ^[4]^[5].
Business Risk: For internet-facing deployments, this vulnerability represents a critical risk as it enables unauthenticated actors to bypass perimeter defenses, potentially leading to total compromise of the security management infrastructure and the networks it protects.

Sources

CVE-2026-16232 - Vulnerability Details - OpenCVE
Apply the latest Check Point SmartConsole security patch that addresses CVE-2026-16232. Configure the SmartConsole login service to only allow connections from trusted IP ranges or a VPN tunnel, thereby blocking unauthenticated external access.
sfewer-r7/CVE-2026-16232
A proof-of-concept script to exploit CVE-2026-16232, an authentication bypass via the SmartConsole login process using an application token. ... CVE-2026-16232 Overview A proof-of-concept script to exploit CVE-2026-16232, an authentication bypass via the SmartConsole login process using an applicati…
sk185169 - CVE-2026-16232 - Authentication bypass with ...
Impact: An unauthenticated attacker can obtain an application login token and use it to login via SmartConsole with full admin privileges and ... CVE-2026-16232 - Authentication bypass with SmartConsole login process using application token Please read this important update from Check Point.
Check Point SmartConsole Zero-Day CVE-2026-16232 ...
CISA added Check Point SmartConsole flaw CVE-2026-16232 (CVSS 9.1) to KEV after in-the-wild exploitation, alongside a SharePoint ...
CVE-2026-16232: Check Point SmartConsole Auth Bypass
CVE-2026-16232 is an authentication bypass flaw in Check Point SmartConsole that lets attackers gain full admin privileges and modify security ... CVE-2026-16232 is an authentication bypass vulnerability in Check Point SmartConsole. Learn about its impact, affected versions, and mitigation methods.

🔴 CVE-2026-16232