Authentication Bypass in the SmartConsole Login Process Using an Application Token (CVE-2026-16232)

What is affected, what to do

CVE-2026-16232 is an authentication bypass vulnerability in Check Point SmartConsole that allows an unauthenticated remote attacker to obtain an application login token and gain full administrative privileges. This enables the attacker to modify security policies and configurations. The vulnerability is actively exploited and affects versions r77.30 to r81.20 of the Multi-Domain-Security-Management product. Immediate patching to the latest version is critical to mitigate the security risks.

The vulnerability is being actively exploited; treat it as a priority. Update multi-domain_security_management to version r81.20, quantum_security_management to version r81.20. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Check Point Quantum Security Management eq R82.10 with Jumbo Hotfix Take 36 or below..R82.10 with Jumbo Hotfix Take 36 or below
• Check Point Quantum Security Management eq R82 with Jumbo Hotfix Take 118 or below..R82 with Jumbo Hotfix Take 118 or below
• Check Point Quantum Security Management eq R81.20 with Jumbo Hotfix Take 158 or below..R81.20 with Jumbo Hotfix Take 158 or below
• Check Point Quantum Security Management eq R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30..R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30
• Check Point Multi-Domain Security Management eq R82.10 with Jumbo Hotfix Take 36 or below..R82.10 with Jumbo Hotfix Take 36 or below
• Check Point Multi-Domain Security Management eq R82 with Jumbo Hotfix Take 118 or below..R82 with Jumbo Hotfix Take 118 or below
• Check Point Multi-Domain Security Management eq R81.20 with Jumbo Hotfix Take 158 or below..R81.20 with Jumbo Hotfix Take 158 or below
• Check Point Multi-Domain Security Management eq R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30..R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Cut internet reachability of the Management Server now. Block inbound traffic from untrusted networks to the management IP (Quantum Security Management or Multi-Domain Server/CMA) at the perimeter. Common SmartConsole and management ports are TCP 18190 (CPMI), 19009 (CPM), 443 (Gaia Portal/Management API) and 18264 (ICA). Verify which ports are actually in use in your environment.
   • Lock down Trusted Clients. In SmartConsole, go to Manage & Settings → Permissions & Administrators → Trusted Clients, remove "Any"/"All IPs" entries and permit only dedicated admin jump hosts or the admin VLAN. Then Publish. Per the vendor, remote exploitation requires both internet access to the management IP and an unrestricted Trusted Clients configuration.
   • Apply the fixed Jumbo Hotfix or Hotfix from the Check Point advisory. Affected builds are R81.20 up to and including JHF Take 158, R82 up to and including Take 118, and R82.10 up to and including Take 36. You need a newer Take or the dedicated hotfix; look up the exact Take number in the vendor advisory or via CPUSE. Cover every domain server in MDS deployments.
   • Treat legacy versions as critical. For R81.10, R81, R80.30, R80.20, R80.10, R80 and R77.30, plan an upgrade to a supported, patched release. Until then, strict network isolation of the management server is mandatory. Check the vendor advisory for any hotfix availability on these versions.
   • Hunt for compromise before declaring the environment clean. Review audit logs and policy revisions for the past several weeks, looking for unknown admin logins, new administrators and rule changes (see Detection rules). If anything looks suspicious: preserve the management server forensically, rotate all admin passwords, API keys and service accounts, restore the last known-good revision and reinstall policy.
   • Assess reporting obligations. Confirmed tampering with the security policy should trigger an assessment of the NIS2 24-hour early warning or, for KRITIS operators, notification to the BSI.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Run the management server only in a dedicated management VLAN, out-of-band where possible, reachable solely from PAW or jump host systems. Place an explicit drop rule "Any (external) → management object" above all accept rules.
   • Remote admin access: Allow SmartConsole access only through MFA-protected VPN. Never publish management ports via NAT. Inventory and remove any existing NAT or port-forwarding rules that point to the management IP.
   • Gaia hardening: Restrict Gaia Portal Allowed Clients (or set allowed-client) to the admin network. Limit Management API exposure (api status, "Accept API calls from") to "Management server only" or to defined IPs.
   • IAM/least privilege: Minimise Super User profiles and give administrators read-only or domain-scoped profiles. Enforce external authentication (RADIUS/TACACS+ with MFA) where available, and disable unused local admin accounts.
   • Change control: Enable session approval (the four-eyes workflow in R81+) for policy publishing. This makes silent rule changes through a hijacked token harder.
   • Upstream IPS: On upstream firewalls or the IPS, alert on and block internet-sourced access to the management ports. Enable the vendor IPS protection for this CVE if one is published (check the advisory).
3. 03

   Runbook step 3

   Detection rules

   • Check Point audit logs (Logs & Monitor → Audit, Log Exporter → SIEM): Flag successful admin logins (operation:"Log In") from source IPs outside the admin network. KQL shape: CheckPointAudit | where Operation == "Log In" and not(ipv4_is_in_range(SourceIP, "10.10.50.0/24")) (adjust the range).

   • Login without preceding authentication events: Treat admin sessions with no matching password or RADIUS authentication record as suspicious, as well as unusual client types or unknown client versions. Also inspect $FWDIR/log/cpm.elg and $FWDIR/log/fwm.elg for sessions created from foreign IPs.

   • Post-exploitation activity: Alert on any of the following:

     • newly created administrators or modified Trusted Clients;
     • new accept rules with Any source or destination;
     • changes to VPN communities, Identity Awareness or logging settings;
     • unscheduled Install Policy operations or database exports.

     Sigma shape: logsource: product: checkpoint, service: audit / selection: operation|contains: ["Create Administrator","Install Policy","Modify Trusted Client"].

   • Network telemetry (Zeek/Suricata/NetFlow): Track connections from public address space to the management IP on TCP 18190, 19009, 443 and 18264. SPL shape: index=netflow dest_ip=<MGMT_IP> dest_port IN (18190,19009,443,18264) NOT src_ip IN (<ADMIN_NETS>).

   • Gaia OS level: Search /var/log/messages and /var/log/secure for new local users, SSH logins from unknown IPs and crontab changes, which indicate persistence.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.

Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, BSI WID Portal, BSI CSAF

Vendors and products

• Check Point Smartconsole
• Check Point Multi-domain Security Management
• Check Point Quantum Security Management

Weakness classes (CWE)

• CWE-287Improper Authentication

  Class

  When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

  Entry at MITRE CWE-287

References & sources

• support.checkpoint.comresults/sk/sk185169Mitigation, Patch, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232government-resource, US government resource
• pwn.watchpwn.watch: Check Point SmartConsole: Check Point SmartConsole Improper Authentication Vulnerabilitypwn-watch
• support.checkpoint.comCheck Point SmartConsole — CVE-2026-16232pwn-watch
• NVD (NIST)NVD: CVE-2026-16232pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 10.08.2026NVD analysis modifiedNVD

   CVSS V3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   CVSS	added	—	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
   Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232 Types: US Government Resource

   Source identifier: nvd@nist.gov

2. 10.08.2026Record modifiedCISA ADP

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232
   Reference	removed	https://vincent.vulcoord.net/score/?state=KEV&state=Reassess&excludecna=linux&cve=CVE-2026-16232&analyze=1	—

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 10.08.2026Record modifiedCISA ADP

   CVSS V3.1: before AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, after —

   CISA assessment (SSVC): exploitation: active, automatable: yes

   New references:

   • https://vincent.vulcoord.net/score/?state=KEV&state=Reassess&excludecna=linux&cve=CVE-2026-16232&analyze=1
   Show 5 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-16232","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-22T00:00:00+00:00"}	{"id":"CVE-2026-16232","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-23T03:55:51.690584Z"}
   CVSS	removed	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	—
   Reference	added	—	https://vincent.vulcoord.net/score/?state=KEV&state=Reassess&excludecna=linux&cve=CVE-2026-16232&analyze=1
   Reference	removed	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232	—
   Reference type	removed	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232 Types: US Government Resource	—

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

4. 03.08.2026NVD analysis modifiedNVD

5. 23.07.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-16232","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-22T20:45:04.891100Z"}	{"id":"CVE-2026-16232","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-22T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

One NVD translation into another language is hidden.

Linked advisories

• @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 29SANS @RISK30.07.2026
• CISA Adds Critical Check Point Flaw to Known Exploited Vulnerabilities CatalogSANS NewsBites27.07.2026
• More Than Two Million Vehicles Contain Vulnerable Anti-Theft SystemsSANS NewsBites21.07.2026