# Check Point SmartConsole login hands an unauthenticated attacker an admin token

Source: https://startwithidentity.com/cves/cve-2026-16232/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

SmartConsole is the GUI administrators use to log in to a Check Point Security Management or Multi-Domain Management server. NVD's description says a flaw in that login process "allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges," from which the attacker can change security policies and configuration. The weakness is improper authentication (CWE-287). NVD scores it CVSS 3.1 9.8; Check Point's CVSS 4.0 score is 9.3. Check Point lists R81.10, R81.20, R82 and R82.10 as affected and says older versions are too.

Remote exploitation needs two conditions: the Management Server IP is reachable from the internet, and the Trusted Clients setting does not restrict which GUI clients may connect. Check Point's July 22, 2026 advisory says it found the bug in an internal review, saw it exploited against "a handful of customers" with that configuration, notified them, and that Smart-1 Cloud customers were already protected. CISA added it to KEV the same day. The same jumbo hotfix fixed CVE-2026-62144, a second management authentication bypass with no exploitation seen.

## Why it matters

The management server is the identity that every gateway obeys. An attacker holding an administrator token does not need a VPN bypass: they can write the firewall and VPN policy, including who may connect remotely and from where. A login token issued before authentication finished is a token for anyone who asks. Pair this with [CVE-2026-50751](https://startwithidentity.com/cves/cve-2026-50751/), a Check Point VPN bypass exploited a month earlier, and both sides of the product were open to the same kind of attacker in 2026.

## What to do

- Install the July 22, 2026 jumbo hotfix (sk185169) on Security Management and Multi-Domain Management servers.
- Limit Trusted Clients to the administrator subnets that need GUI access, and keep the implied rules for control connections enabled.
- Take the Management Server off the internet. Put admin access behind a [ZTNA](https://startwithidentity.com/glossary/ztna/) or a jump host with [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/).

## After you patch

- Review the management audit log for SmartConsole sessions from the six IP addresses Check Point published, and for policy installs nobody requested.
- Diff the current policy against a known-good revision and reset administrator passwords and API keys if anything changed.

## Sources

- [NVD: CVE-2026-16232](https://nvd.nist.gov/vuln/detail/cve-2026-16232)
- [Check Point: July 2026 security update, July 22, 2026](https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232/)
- [Check Point sk185169](https://support.checkpoint.com/results/sk/sk185169)
- [CISA Known Exploited Vulnerabilities catalog, added July 22, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232)