Check Point SmartConsole Authentication Bypass Technical Analysis (CVE-2026-16232)
A critical authentication bypass vulnerability, CVE-2026-16232, has been actively exploited in the wild in Check Point's SmartConsole login process. This flaw affects the Security Management Server and Multi-Domain Security Management Server. By exploiting this issue, an unauthenticated attacker can obtain a login token and gain full administrative privileges, enabling them to modify security policies or configurations. The vulnerability stems from a broken trust boundary in the authentication path, allowing attackers to forge identities and bypass secure checks. Patches have been released by Check Point, and Rapid7 has shared a proof-of-concept script to test whether systems are vulnerable.
Overview
On July 22, 2026, Check Point published a security advisory for CVE-2026-16232, an authentication bypass in the SmartConsole login process affecting Security Management Server and Multi-Domain Security Management Server (MDS). By leveraging CVE-2026-16232, an unauthenticated attacker can obtain an application login token, use this token to log in through SmartConsole with full administrator privileges, and modify the security policy or security configuration. Exploitation requires network access to the Management Server and for a Trusted Clients configuration that does not restrict GUI clients, which in our testing was a default setting. This vulnerability was reported as being exploited in the wild as a zero-day vulnerability at the time of disclosure.…