Check Point SmartConsole Authentication Bypass CVE-2026-16232 Under Active Exploitation

Key Findings

• Check Point SmartConsole authentication bypass CVE-2026-16232 is actively exploited in the wild with a critical CVSS score of 9.3
• Attackers can bypass login using an application token to gain full administrative access without credentials
• Only a small number of customers with specific configurations are currently targeted, primarily those exposing Management directly to the internet
• Two additional authentication and privilege escalation flaws were also disclosed: CVE-2026-62144 (CVSS 9.3) and CVE-2026-62145 (CVSS 7.5)
• Jumbo hotfix released July 22, 2026, with CISA adding CVE-2026-16232 to its Known Exploited Vulnerabilities catalog
• Five known attacker IP addresses have been shared as indicators of compromise

Background

Check Point discovered the authentication bypass flaw during routine internal security reviews as part of its BLAST program. The company disclosed the vulnerability on July 22, 2026, and confirmed active exploitation against a select group of customers. Security Management and Multi-Domain Management products are impacted across multiple versions from R77.30 through R82.10.

How the Attack Works

The vulnerability allows an unauthenticated attacker to obtain an application login token and use it to authenticate with full administrative privileges. Once inside, an attacker can modify security policies and configurations, essentially gaining complete control over the management infrastructure. Successful exploitation requires the Management Server to be directly exposed to the internet without IP restrictions on trusted clients. The narrow attack surface has limited the real-world impact so far.

Affected Products and Versions

The flaw impacts Security Management and Multi-Domain Management across multiple release branches. Vulnerable versions include R77.30, R80, R80.10, R80.20, R80.30, R81, R81.10, R81.20, R82, and R82.10. Organizations running any of these versions should treat this as a priority issue.

Related Vulnerabilities

Two companion flaws were patched alongside CVE-2026-16232. CVE-2026-62144 is another authentication bypass that allows unauthenticated attackers to execute administrative commands on the Management Server, including run-script and exec-command on Security Gateway. CVE-2026-62145 is a privilege escalation flaw in the Gaia Portal WebUI that allows read-only authenticated users to execute commands with root privileges. Neither has been observed in active exploitation yet.

Indicators of Compromise

Check Point released five IP addresses associated with the ongoing attacks:

• 151.241.99.207
• 151.241.99.233
• 158.62.198.182
• 192.142.10.99
• 139.28.37.250
• 194.213.18.137

Organizations should monitor for connections from these addresses and implement network-based protections.

Immediate Actions Required

Install the jumbo hotfix released on July 22, 2026 immediately. Restrict trusted GUI clients to specific IP addresses rather than allowing all trusted sources. Place Management access behind a firewall and block untrusted networks from reaching it. CISA has mandated that Federal Civilian Executive Branch agencies apply patches by July 25, 2026, indicating the severity of the threat.

Sources

• https://securityonline.info/check-point-smartconsole-cve-2026-16232/
• https://thehackernews.com/2026/07/check-point-patches-exploited.html
• https://securityaffairs.com/195848/hacking/check-point-patches-actively-exploited-smartconsole-authentication-bypass-flaw.html
• https://mallory.ai/stories/019f8b06-b84f-7a00-ba37-5990a265fab9