CVE-2026-16232
Authentication Bypass in the SmartConsole Login Process Using an Application Token
Description
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
In plain language
AI Act nowCVE-2026-16232 is an authentication bypass in Check Point SmartConsole that lets an attacker log in as an administrator without a password; if your SmartConsole Management Server is reachable from the internet with no “Trusted Clients” restrictions, you should treat this as an urgent emergency patch.
CVE-2026-16232 is an authentication bypass in the SmartConsole login process where an unauthenticated remote attacker can obtain an application login token and then authenticate with full administrative privileges; it is confirmed in the CISA KEV and being exploited in the wild.
What to do now
- Check whether your Check Point SmartConsole Management Server is reachable from the internet (publicly accessible IP/port) and whether “Trusted Clients” restrictions are configured for the Management Server login path.
- If it is internet-reachable and Trusted Clients are not restricted, treat it as vulnerable and prepare to block the internet path immediately while you schedule the fix.
- Upgrade both affected products to the fixed release: quantum security management and Multi-Domain Security Management to r81.20.
- Apply Check Point’s vendor guidance/mitigation steps from the referenced support article if you cannot upgrade right away.
CVSS Vector Breakdown
AV:NAttack VectorAC:LAttack ComplexityPR:NPrivileges RequiredUI:NUser InteractionS:UScopeC:HConfidentialityI:HIntegrityA:NAvailabilityWeaknesses
Affected Products
Exploitability
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Attack Graph
Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.
MITRE ATT&CK
2 techniquesReferences
- CVE-2026-16232: Critical Check Point SmartConsole Authentication Bypass Exploited in the Wilden·Rapid7 Blog· Exploited Security Management auth-bypass
- Attackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232)en-us·Help Net Security· Exploited Check Point Security Management auth-bypass
- New Check Point Zero-Day Vulnerability Exploited in the Wilden-us·SecurityWeek· Exploited Security Management zero-day
- Check Point warns of SmartConsole zero-day exploited in attacksen-us·BleepingComputer· Exploited SmartConsole zero-day
- Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Accessen·The Hacker News· Exploited SmartConsole zero-day
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-16232 and every CVE in our database. Create a free account — no credit card required.
Create Free Account