Check Point SmartConsole authentication bypass to full admin (exploited)

CVE-2026-16232 — Check Point SmartConsole: authentication bypass to full admin, exploited in the wild (CVSS 9.1)

The flaw sits in the SmartConsole login process of Check Point Security Management and Multi-Domain Security Management (CWE-287): an unauthenticated remote attacker who can reach the Management Server obtains an application login token and uses it to authenticate to SmartConsole with full administrative privileges, from which they can rewrite firewall security policy and configuration (Check Point Software, 2026-07-22). The precondition is narrow but severe: the Management Server must be exposed directly to the internet with no Trusted-Clients (GUI-client IP allow-list) restriction — Check Point states this "only affects a very specific configuration" and confirms active exploitation against "a handful of customers with specific configurations" (Check Point Software, 2026-07-22). CISA added the CVE to its Known Exploited Vulnerabilities catalogue the same day it was disclosed (CISA, 2026-07-22). The score is carried as 9.1 (NVD's assignment) though Check Point's advisory prints 9.3; both are critical. No exploiting cluster has been named.