← News
/DISPATCH · 2026-07-29

CVE-2026-16232: Check Point SmartConsole Auth Bypass Exploited in the Wild

Check Point disclosed CVE-2026-16232, an authentication bypass already exploited in the wild. Unauthenticated remote attackers can obtain an admin token and fully control firewall policy. CISA added it to the KEV catalog.

On 22 July 2026 Check Point issued an emergency advisory for CVE-2026-16232, a critical authentication bypass in the SmartConsole login flow. The bug is actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog and set a 25 July remediation deadline for federal agencies.

Incident Overview

CVE-2026-16232 affects Check Point Security Management Server and Multi-Domain Security Management Server (MDS). The flaw is a trust-boundary defect in application authentication during SmartConsole login. An unauthenticated remote attacker can obtain an application login token and sign into SmartConsole with full admin rights.

Once in, the attacker can change firewall policy and security configuration end to end. Check Point confirmed a small number of customers were hit. Exploit does not need a username, password, or MFA.

Technical Details

Root cause

Per Rapid7, the failure is a trust-boundary bug on the application-auth path. Affected servers, when handling SIC (Secure Internal Communication) certificates, accept an attacker-supplied SIC distinguished name (DN) as the remote application's identity instead of binding that identity to the authenticated peer certificate DN.

Exploit steps:

Scope

Impact Assessment

| Dimension | Assessment | |---|---| | CVSS 4.0 | 9.3 Critical | | CVSS 3.1 | 9.1 Critical | | Exploit bar | network-reachable, unauthenticated | | Impact | full firewall-policy control; security-config changes | | In the wild | confirmed; small number of customers hit |

This is Check Point's second confirmed in-the-wild CVE in six weeks. In June, CVE-2026-50751 (IKEv1 VPN auth bypass) was used by the Qilin ransomware gang.

Remediation

Patch now

Check Point shipped a Jumbo Hotfix on 22 July. Every Security Management Server and MDS on an affected version must apply it immediately. The same day also fixed:

Temporary mitigations

Until patched:

Detection and forensics

Query SmartConsole audit logs for `Authentication method: application token` as a potential-compromise indicator. Check Point published these IOC IPs:

References