CVE-2026-16232Check Point SmartConsole login hands an unauthenticated attacker an admin token
What broke
SmartConsole is the GUI administrators use to log in to a Check Point Security Management or Multi-Domain Management server. NVD's description says a flaw in that login process "allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges," from which the attacker can change security policies and configuration. The weakness is improper authentication (CWE-287). NVD scores it CVSS 3.1 9.8; Check Point's CVSS 4.0 score is 9.3. Check Point lists R81.10, R81.20, R82 and R82.10 as affected and says older versions are too.
Remote exploitation needs two conditions: the Management Server IP is reachable from the internet, and the Trusted Clients setting does not restrict which GUI clients may connect. Check Point's July 22, 2026 advisory says it found the bug in an internal review, saw it exploited against "a handful of customers" with that configuration, notified them, and that Smart-1 Cloud customers were already protected. CISA added it to KEV the same day. The same jumbo hotfix fixed CVE-2026-62144, a second management authentication bypass with no exploitation seen.
Why it matters
The management server is the identity that every gateway obeys. An attacker holding an administrator token does not need a VPN bypass: they can write the firewall and VPN policy, including who may connect remotely and from where. A login token issued before authentication finished is a token for anyone who asks. Pair this with CVE-2026-50751, a Check Point VPN bypass exploited a month earlier, and both sides of the product were open to the same kind of attacker in 2026.
What to do
- Install the July 22, 2026 jumbo hotfix (sk185169) on Security Management and Multi-Domain Management servers.
- Limit Trusted Clients to the administrator subnets that need GUI access, and keep the implied rules for control connections enabled.
- Take the Management Server off the internet. Put admin access behind a ZTNA or a jump host with phishing-resistant MFA.
After you patch
- Review the management audit log for SmartConsole sessions from the six IP addresses Check Point published, and for policy installs nobody requested.
- Diff the current policy against a known-good revision and reset administrator passwords and API keys if anything changed.
Sources
Related identity CVEs
Related on Start with Identity
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- CVEIvanti Endpoint Manager authentication bypass leaks stored credentials
An authentication bypass in Ivanti Endpoint Manager before 2024 SU5 let an unauthenticated remote attacker read specific stored credential data. Patched Februar
- CVEJFrog Artifactory hands its internal anonymous-user token to unauthenticated callers
Self-hosted Artifactory could return an internal anonymous-user token to an unauthenticated request even with anonymous access disabled. Attackers chained it wi
- BlogA Check Point SmartConsole flaw hands out full admin tokens to unauthenticated attackers
CVE-2026-16232 (CVSS 9.3) lets an unauthenticated remote attacker obtain an application login token for Check Point Security Management and Multi-Domain Managem
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a