Intel

CVE-2026-16232

Check Point SmartConsole — Check Point SmartConsole Improper Authentication Vulnerability

criticalKEV: actively exploitedPoCEPSS 72%

Description

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.

Source: CISA_KEVNVDCVELISTV5BSIBSI_CSAF

Response & Mitigation

Why act now?

Prioritisation rationale

With a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and an EPSS percentile of 99.4 %, this vulnerability represents the highest possible operational risk for any organisation running an internet-exposed Check Point Management Server without Trusted Clients restrictions. Successful exploitation grants an unauthenticated attacker full administrative control over the firewall management plane, enabling them to silently modify or disable security policies and effectively neutralise the organisation's entire perimeter defence — a direct enabler for subsequent lateral movement and data exfiltration. Organisations in NIS2-regulated sectors (KRITIS) must assess whether a confirmed compromise triggers the 24-hour initial notification obligation to their competent authority. Although CISA has not flagged known ransomware campaign use, administrative control over a security management platform is a high-value objective for virtually every threat actor class and should be treated as a Severity-1 incident until the patch is confirmed deployed and no unauthorised changes are found.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch: Check Point has released a hotfix addressing CVE-2026-16232 — retrieve the exact build number and download link from the official Check Point Security Advisory (sk article) and deploy it immediately on all Security Management Servers and Multi-Domain Security Management servers running R77.30 through R81.20.
  • Enforce Trusted Clients restriction now: In SmartConsole navigate to Manage & Settings → Blades → Management → Trusted Clients and restrict access to explicitly approved IP addresses or subnets. Remove any wildcard (Any) entries. This is the single most effective compensating control if the patch cannot be applied immediately.
  • Block internet-facing access to management ports: At the perimeter firewall, block inbound TCP on port 19009 (SmartConsole login) and port 443 (Management API) from all sources except the VPN concentrator or dedicated out-of-band management network. Management access must not traverse the internet directly.
  • Audit and terminate active sessions: List all currently active SmartConsole sessions via cpstat mg or SmartView Monitor, identify any sessions originating from unexpected source IPs, and terminate them immediately. Review the management audit log for authentication events over the past 72 hours.
  • Rotate all administrator credentials: Reset passwords for every local and LDAP-bound SmartConsole administrator account; revoke and reissue API keys and certificates used by automation integrations.
  • Diff security policies against last known-good backup: Use SmartConsole Revision Control or cppkg to generate a full policy diff against the most recent trusted backup and manually validate every rule change since the KEV addition date (2026-07-22).

Runbook · Step 2

Mitigation layers

  • Network segmentation: Place the Management Server in a dedicated management VLAN. Permit TCP 19009 and 443 only from the management VLAN and VPN concentrator subnet; drop all other sources at both the perimeter and on the Management Server host firewall (fw ctl).
  • IPS signature: On upstream IPS systems (Check Point IPS Blade, Suricata, etc.) activate or create a rule targeting anomalous authentication traffic on port 19009. Example Suricata rule: alert tcp any any -> $MGMT_SERVER 19009 (msg:"CVE-2026-16232 SmartConsole Auth Bypass Attempt"; flow:to_server,established; content:"login"; nocase; threshold:type both,track by_src,count 3,seconds 10; sid:9262232; rev:1;) — tune the threshold to your baseline.
  • Enforce multi-factor authentication: If not already active, enable MFA for all SmartConsole administrators via RADIUS/LDAP with OTP tokens. A stolen login token alone will not be sufficient to complete a session takeover when MFA is enforced.
  • Restrict Management API access: If no active automation integration requires it, disable the Management API (api status) or limit it to specific client IPs: mgmt_cli set-api-settings accepted-api-calls-from "specific-ip-only".
  • Least-privilege administrator roles: Reduce existing SmartConsole accounts to minimal role profiles (Read-Only or Policy-Editor without Publish rights); reserve full Superuser rights for break-glass accounts stored in a separate privileged access vault.

Runbook · Step 3

Detection rules

  • Token abuse in audit log: Filter Check Point Management audit log ($FWDIR/log/cpaudit.log) for action:Login events where src_ip is outside the Trusted Clients list. SPL: index=checkpoint sourcetype=cp_audit action="Login" | where NOT match(src_ip, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)") | stats count by src_ip, admin_name
  • Brute-force-then-success pattern: Sigma rule shape — source: SmartConsole audit log; condition: ≥3 LoginFailed events followed by LoginSucceeded within 60 seconds from the same source IP → severity: Critical.
  • Off-hours policy changes: Correlate Zeek/Netflow connections to port 19009 from external IPs outside business hours (e.g. 22:00–06:00 local time) with subsequent install-policy events in the audit log → high-severity alert.
  • Unexpected child processes on the Management Server (Linux): auditd rule monitoring execve calls spawned by the fwm process: auditctl -a always,exit -F arch=b64 -F ppid=$(pgrep fwm) -S execve -k cve_2026_16232. Unexpected shells (/bin/bash, python3) are indicators of post-exploitation activity.
  • Network telemetry anomaly: In Suricata or Zeek, flag completed TCP sessions (SYN-ACK + data transfer > 1 KB) on port 19009 originating from IPs outside the defined Trusted Clients range as a high-confidence exploitation indicator.

Metrics

Severity
critical
Priority score
236.18
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
9.8
Source: nvd-v3
CVSS v3
9.8
CVSS v4
9.3
EPSS percentile
99.4 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
72.0 %
High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
Published
2026-07-22 00:00 UTC
CWE
CWE-287

Weakness classes (CWE)

  • CWE-287Class

    Improper Authentication

    When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. Modified Analysis2026-08-10 19:59 UTC· nvd@nist.gov
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    • Reference Type: CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232 Types: US Government Resource
  2. CVE Modified2026-08-10 19:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • Reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232
    • Reference: https://vincent.vulcoord.net/score/?state=KEV&state=Reassess&excludecna=linux&cve=CVE-2026-16232&analyze=1
  3. CVE Modified2026-08-10 18:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-16232","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic… → {"id":"CVE-2026-16232","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic…
    • CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    • Reference: https://vincent.vulcoord.net/score/?state=KEV&state=Reassess&excludecna=linux&cve=CVE-2026-16232&analyze=1
    • Reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232
  4. Modified Analysis2026-08-03 12:15 UTC· nvd@nist.gov
  5. CVE Modified2026-07-23 05:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-16232","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic… → {"id":"CVE-2026-16232","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic…

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • checkpoint

    multi-domain_security_managementr77.30 – r81.20

  • checkpoint

    multi-domain_security_management

  • checkpoint

    quantum_security_managementr77.30 – r81.20

  • checkpoint

    quantum_security_management

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

Linked advisories

IDCVE-2026-16232