Vulnerability record · CVE-2026-16232 · published 22 July 2026
CVE-2026-16232: Check Point SmartConsole authentication bypass grants admin token
Checkpoint · Multi Domain Security Management
Check Point SmartConsole login contains an improper authentication flaw (CWE-287) that lets an unauthenticated remote attacker obtain an application login token and authenticate with full administrative privileges. Because the token yields admin access, an exposed Management Server can be taken over without credentials. Check Point states the flaw is being exploited against a very small number of customers.
Description
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:
Automated analysis
critical priorityUnauthenticated remote admin takeover with confirmed exploitation, KEV listing and a 99.4th percentile EPSS score.
What it is
Check Point SmartConsole login contains an improper authentication flaw (CWE-287) that lets an unauthenticated remote attacker obtain an application login token and authenticate with full administrative privileges. Because the token yields admin access, an exposed Management Server can be taken over without credentials. Check Point states the flaw is being exploited against a very small number of customers.
Impact
An attacker gains full administrative control of the management server, allowing modification of security policies and security configurations. That effectively lets them weaken or disable protections across managed gateways.
Attack surface
Reachable over the network via the SmartConsole login process on the Management Server IP address; no authentication or user interaction is required per the CVSS 4.0 vector (AV:N/PR:N/UI:N). Exploitation requires the Management Server to be internet-accessible and a configuration that does not restrict Trusted Clients.
Exploitation
Active exploitation is confirmed: the CVE is in CISA KEV (added 2026-07-22, due 2026-07-25) and Check Point acknowledges real-world exploitation. EPSS is 0.72051 (99.4th percentile), indicating high predicted likelihood.
What to do
- Apply the Check Point fix from vendor advisory sk185169 immediately; treat this as emergency patching given the KEV due date.
- Restrict SmartConsole access to trusted client IPs and remove direct internet exposure of the Management Server.
- Block external access to the management interface at the perimeter until patching is verified.
- Review and rotate administrative credentials and tokens, and audit admin accounts for unauthorized changes.
- If mitigations cannot be applied, follow CISA BOD 26-04 guidance, including discontinuing use of the affected product.
Detection
- Hunt SmartConsole login and token-issuance logs for successful admin sessions from unexpected or external source IPs.
- Alert on authentication events without a preceding credential exchange or from IPs outside the Trusted Clients list.
- Monitor for unauthorized changes to security policies, objects and management configuration, and correlate them with recent logins.
- Review Management Server exposure and firewall logs for inbound connections to the management interface from the internet.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-16232 to the Known Exploited Vulnerabilities catalog on 22 July 2026 as "Check Point SmartConsole Improper Authentication Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 25 July 2026.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://support.checkpoint.com/results/sk/sk185169 | MitigationPatchVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232 | US Government Resource |
Track CVE-2026-16232 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-16232), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
