CVE-2026-16232
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Jul 22, 2026
- US federal agencies must remediate it by Jul 25, 2026 (BOD 22-01)
- Attacked 4 days before the vulnerability was made public
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Source: CISA KEV · Aug 17, 2026 Aug 7, 2026 Jul 28, 2026 Jul 23, 2026 Jul 22, 2026 Jul 22, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HAffected products
| Vendors | Product | Versions |
|---|---|---|
| checkpoint | multi-domain security management | < r81.20 |
| checkpoint | quantum security management | < r81.20 |
Related articles
VulnerabilitiesCheck Point Alert: Critical Authentication Bypass in SmartConsole Exploited in the Wild, PoC Released
CVE-2026-16232 allows remote attackers to bypass auth in Check Point SmartConsole and get admin roles. Apply Jumbo Hotfixes now.
VulnerabilitiesCheck Point Patches Two Critical VPN Certificate Flaws Allowing Unauthenticated RCE
Check Point fixes two critical VPN certificate flaws, CVE-2026-85102 and CVE-2026-85103, with CVSS 9.8, enabling unauthenticated RCE on Security Gateways and Management.
This product uses the NVD API but is not endorsed or certified by the NVD.