--- schema: 1 kind: vulnerability title: > CVE-2026-16232 — Check Point SmartConsole: authentication bypass to full admin, exploited in the wild (CVSS 9.1) headline: > Check Point patches an actively-exploited SmartConsole authentication bypass granting full management-server admin summary: > CVE-2026-16232 (CVSS 9.1) is an authentication-bypass flaw in the Check Point SmartConsole login process of Security Management and Multi-Domain Security Management (R81.10, R81.20, R82, R82.10+). An unauthenticated attacker who can reach an internet-exposed Management Server with no Trusted-Clients restriction obtains an application login token and authenticates as a full administrator; Check Point confirms active exploitation against a handful of customers with that specific exposure, CISA added it to KEV on 2026-07-22, and a same-day Jumbo Hotfix is available. discovered_at: "2026-07-23T04:34:04Z" updated_at: "2026-07-29T05:15:00Z" event_date: 2026-07-22 run_id: 2026-07-23T0409Z-intel priority: high immediate_action: null tags: - vulnerabilities - auth-bypass - actively-exploited - pre-auth - cisa-kev - patch-available - rce - priv-esc - default-config - poc-public - identity regions: - global sectors: - public-sector - energy - finance - telco - healthcare - transport - water entities: [] techniques: - T1190 - T1068 - T1606 affected_products: - Check Point SmartConsole - Check Point Security Management - Check Point Multi-Domain Security Management - Check Point Security Management Server - Check Point Multi-Domain Security Management Server - Check Point Gaia Portal cves: - id: CVE-2026-16232 cvss: "9.1" epss: null type: auth-bypass vector: zero-click auth: pre-auth status: - exploited - cisa-kev - poc-public - patch-available affected: > Rapid7 reproduced the flaw against R81.20 and R82.10, working from a vulnerable R81.20 Jumbo Hotfix Take 146 build. The full affected-version set is carried by the original 2026-07-23 entry and its vendor sourcing; this update adds only the builds Rapid7 tested. fixed: > R81.20 Jumbo Hotfix Take 158 is the patched build Rapid7 diffed against and confirmed stops its proof-of-concept. Vendor-authoritative fixed versions across the other trains remain as recorded in the original entry. - id: CVE-2026-62144 cvss: "10.0" epss: null type: rce vector: zero-click auth: pre-auth status: - patch-available affected: > Security Management / Multi-Domain Security Management on R77.30, R80.x, R81/R81.10/R81.20, R82/R82.10 prior to fix fixed: "Jumbo Hotfix Accumulator: R82.10 Take 36+, R82 Take 118+, R81.20 Take 158+" - id: CVE-2026-62145 cvss: "7.5" epss: null type: priv-esc vector: zero-click auth: post-auth status: - patch-available affected: Gaia Portal on Security Gateways and Security Management (Spark Gateways not affected) fixed: "Jumbo Hotfix Accumulator: R82.10 Take 36+, R82 Take 118+, R81.20 Take 158+" sources: - url: "https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232/" publisher: Check Point Software date: 2026-07-22 role: primary - url: "https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog" publisher: CISA date: 2026-07-22 role: primary - url: "https://euvd.enisa.europa.eu/enisa/eu_vulnerability_database/EUVD-2026-47700" publisher: ENISA EUVD date: 2026-07-22 role: corroborating - url: "https://support.checkpoint.com/results/sk/sk185152" publisher: Check Point PSIRT (sk185152) date: 2026-07-22 role: primary - url: "https://support.checkpoint.com/results/sk/sk185153" publisher: Check Point PSIRT (sk185153) date: 2026-07-22 role: primary - url: "https://advisories.ncsc.nl/2026/ncsc-2026-0264.html" publisher: NCSC-NL date: 2026-07-24 role: corroborating - url: "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0912/" publisher: CERT-FR / ANSSI date: 2026-07-23 role: corroborating - url: "https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232" publisher: Rapid7 Labs date: 2026-07-28 role: primary closed_sources: [] evidence: - quote: This only affects a very specific configuration — when Management is exposed directly to the internet without IP restrictions. publisher: Check Point Software - quote: "Yes, for a handful of customers with specific configurations" publisher: Check Point Software - quote: An unauthenticated attacker can run any command on the Management including run-script and exec-command on Security Gateway. publisher: Check Point PSIRT (sk185152) - quote: A vulnerability in Gaia Portal allows an authenticated attacker with read-only access to run commands as root. publisher: Check Point PSIRT (sk185153) - quote: "Exploitation requires network access to the Management Server and for a Trusted Clients configuration that does not restrict GUI clients, which in our testing was a default setting." publisher: Rapid7 Labs - quote: "By leveraging CVE-2026-16232, an unauthenticated attacker can obtain an application login token, use this token to log in through SmartConsole with full administrator privileges, and modify the security policy or security configuration." publisher: Rapid7 Labs - quote: "The native FWM authorization code has a special case for this command. If the current client is treated as a Check Point config administrator (which it will be), a gen-sso-token request is allowed before the normal permission mask check" publisher: Rapid7 Labs - quote: Rapid7 Labs has reproduced CVE-2026-16232 against affected R81.20 and R82.10 versions of the target software. Our proof-of-concept (PoC) exploit script can be used to successfully validate if a target is either vulnerable or patched. publisher: Rapid7 Labs verification: multi-source sourcing_note: > CVSS split: this entry uses 9.1 (the NVD-assigned score, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, which the vector math confirms) while Check Point's PSIRT advisory prints 9.3 — both are critical and priority is unaffected either way (the NVD per-CVE page is not cited as a source per link discipline). The ENISA EUVD record (EUVD-2026-47700) was fetched during research and logged live, but EUVD returned an app-unavailable shell on re-check this run, so no EUVD-only quote is relied on — the exploitation-status evidence rests on Check Point's own advisory and the CISA KEV listing. confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: A credibility: 1 watchlist_hit: false actions: - "Restrict SmartConsole 'Trusted Clients' (the GUI-client IP allow-list) on every internet-reachable Check Point Security Management and Multi-Domain Management server to known administrator IPs now — the network-layer restriction neutralises the token bypass independent of patch state — and apply the 2026-07-22 Jumbo Hotfix." - "On any Management Server that was internet-exposed without a Trusted-Clients restriction, review SmartConsole authentication logs for logins authenticated via application token from outside the admin IP range and audit the security-policy and object change history for unexpected administrative changes." - "If you deferred the Check Point Jumbo Hotfix (R82.10 Take 36+ / R82 Take 118+ / R81.20 Take 158+) because CVE-2026-16232 was mitigated by network restrictions, apply it now — the same bundle closes an unauthenticated command-execution flaw (CVE-2026-62144) on the identical management surface." - "Check the Trusted Clients configuration on every Check Point Security Management and Multi-Domain Management server: Rapid7 found the GUI-client-unrestricted setting that makes this exploitable is the default, so restricting SmartConsole access to known administrative addresses removes the reachability the exploit depends on even where patching lags." updates: - at: "2026-07-25T04:38:26Z" run_id: 2026-07-25T0409Z-intel type: update summary: > NCSC-NL (2026-07-24) and CERT-FR (2026-07-23) confirm two sibling CVEs shipped in the same Check Point patch bundle as the already-exploited SmartConsole auth bypass CVE-2026-16232: CVE-2026-62144, an unauthenticated command-execution flaw on Security Management / MDS servers (NCSC-NL CVSS v4 10.0; Check Point rates it High), and CVE-2026-62145, a Gaia Portal read-only-to-root escalation (Check Point CVSS 3.1 7.5; NCSC-NL CVSS v4 9.4). Both sit on the exact management surface already under active attack. fields: - actions - affected_products - cves - evidence - sources - tags - techniques - body merged_from: 2026-07-25/check-point-mgmt-cve-2026-62144-62145-siblings - at: "2026-07-29T05:15:00Z" run_id: 2026-07-29T0408Z-intel type: update summary: > Rapid7 Labs published the root cause of CVE-2026-16232 on 2026-07-28, the Check Point SmartConsole authentication bypass already confirmed exploited and CISA KEV-listed. The vulnerable method preferred a caller-supplied SIC distinguished name over the DN bound to the authenticated peer certificate, so a remote client that replayed the management server's own SIC DN was accepted as that identity with no client certificate — then used the forged application session to request an SSO token claiming system_admin with a full permission bitmap, and redeemed it for a full-administrator session. Rapid7 reproduced this against R81.20 and R82.10, and states the Trusted Clients configuration that permits it was the default in its testing. fields: - actions - cves - evidence - sources - tags - techniques - body merged_from: 2026-07-29/check-point-cve-2026-16232-sic-dn-substitution-root-cause migrated_from: null --- The flaw sits in the SmartConsole login process of Check Point Security Management and Multi-Domain Security Management (CWE-287): an unauthenticated remote attacker who can reach the Management Server obtains an application login token and uses it to authenticate to SmartConsole with full administrative privileges, from which they can rewrite firewall security policy and configuration ([Check Point Software, 2026-07-22](https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232/)). The precondition is narrow but severe: the Management Server must be exposed directly to the internet with no Trusted-Clients (GUI-client IP allow-list) restriction — Check Point states this "only affects a very specific configuration" and confirms active exploitation against "a handful of customers with specific configurations" ([Check Point Software, 2026-07-22](https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232/)). CISA added the CVE to its Known Exploited Vulnerabilities catalogue the same day it was disclosed ([CISA, 2026-07-22](https://www.cisa.gov/news-events/alerts/2026/07/22/cisa-adds-two-known-exploited-vulnerabilities-catalog)). The score is carried as 9.1 (NVD's assignment) though Check Point's advisory prints 9.3; both are critical. No exploiting cluster has been named. **Defender takeaway:** the network-layer control is decisive here — restricting Trusted Clients to known administrator IP ranges neutralises the token bypass even before the hotfix is applied, and a Management Server should never be reachable directly from the internet. In authentication and session telemetry on the Management Server, the observable is a SmartConsole login authenticated by an application token rather than an interactive credential exchange, particularly from a source IP outside the known administrator range; correlate any such login with the immediately-following security-policy or object-change audit records. **Triage:** legitimate administrators authenticate through the interactive credential flow from known management stations — a full-admin session established via login token from an unexpected source, followed by policy edits, is the signal that separates exploitation from routine administration. ## Update — 2026-07-25T04:38:26Z The prior entry covered the actively-exploited Check Point SmartConsole authentication bypass CVE-2026-16232. NCSC-NL advisory NCSC-2026-0264 (2026-07-24) and CERT-FR CERTFR-2026-AVI-0912 (2026-07-23) now confirm that the same Check Point patch release carried two further CVEs on the same attack surface that had not been surfaced individually ([NCSC-NL, 2026-07-24](https://advisories.ncsc.nl/2026/ncsc-2026-0264.html); [CERT-FR, 2026-07-23](https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0912/)). CVE-2026-62144 (NCSC-NL CVSS v4 10.0; Check Point publishes only a qualitative "High" severity, no numeric CVSS 3.1 score) lets an unauthenticated network attacker "run any command on the Management including run-script and exec-command on Security Gateway" — i.e. arbitrary command execution against a Security Management or Multi-Domain Security Management server, and by extension against every gateway that server manages, whenever the Management is reachable without firewall protection or with an unrestricted Trusted Clients (GUI clients) list ([Check Point PSIRT sk185152, 2026-07-22](https://support.checkpoint.com/results/sk/sk185152)). CVE-2026-62145 (Check Point CNA CVSS 3.1 7.5; NCSC-NL CVSS v4 9.4) is a Gaia Portal escalation in which "an authenticated attacker with read-only access [can] run commands as root," affecting Security Gateways and Security Management alike (Spark Gateways excepted) ([Check Point PSIRT sk185153, 2026-07-22](https://support.checkpoint.com/results/sk/sk185153)). Both span the same version range as the exploited CVE-2026-16232 (R77.30 through R81.20/R82/R82.10 prior to fix) and both close with the same Jumbo Hotfix Accumulator line. The material delta for defenders is exposure, not new exploitation: Check Point reports only CVE-2026-16232 seen abused, against a small number of customers who left the Management internet-exposed with a permissive Trusted Clients configuration ([NCSC-NL, 2026-07-24](https://advisories.ncsc.nl/2026/ncsc-2026-0264.html)). **Defender takeaway:** an organization that mitigated CVE-2026-16232 with network restrictions rather than the hotfix still carries an *unauthenticated* command-execution flaw (CVE-2026-62144) on the same management plane — the network control is the only thing standing between an attacker and the CA of the firewall estate. **Detection:** on the Management server, monitor authentication/session logs for administrative API or token-issuance events with no preceding interactive admin login, and for `run-script`/`exec-command` invocations against gateways sourced from the Management's own automation context rather than a known SmartConsole GUI session; for the Gaia Portal flaw, alert on any root-context command execution tied to a session that authenticated at read-only privilege — that pairing is definitionally the abuse condition. Restrict the Trusted Clients list to specific management IPs and block the Management server's internet reach entirely. ## Update — 2026-07-29T05:15:00Z The earlier entry recorded that this Check Point Security Management authentication bypass was being exploited in the wild and had been added to CISA's KEV catalog, but not how it worked. Rapid7 Labs has now published the mechanics, reverse-engineered from decompiled Java across a vulnerable R81.20 Jumbo Hotfix Take 146 build and the patched Take 158 ([Rapid7 Labs, 2026-07-28](https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232)). The root cause is a trust boundary drawn in the wrong place. A SmartConsole login crosses two generations of management-plane plumbing: the legacy FWM/CPMI service on TCP 18190, which uses Check Point's SIC certificate-based trust mechanism, and the newer CPM/DLE SOAP service on TCP 19009 under the `/cpmws/` path ([Rapid7 Labs, 2026-07-28](https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232)). In the vulnerable build, the method that authenticates a remote application preferred whatever SIC distinguished name the *caller* supplied, falling back to the DN bound to the authenticated peer certificate only when the caller supplied none — so a remote client that simply copied the management server's own SIC DN into that field was accepted as that identity, with no client certificate ever presented ([Rapid7 Labs, 2026-07-28](https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232)). What turns that identity confusion into full administrative control is a second, separate authorization shortcut. Holding the forged application identity, the attacker issues a `gen-sso-token` request to the legacy FWM service claiming `system_admin` with all bits set across the permission mask; Rapid7's decompilation shows FWM allows that command before the normal permission-mask check whenever the client is treated as a Check Point config administrator — which the forged identity guarantees ([Rapid7 Labs, 2026-07-28](https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232)). The resulting SSO ticket is then redeemed through the ordinary SmartConsole login path for a full-administrator session able to modify security policy and configuration ([Rapid7 Labs, 2026-07-28](https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232)). The Take 158 patch narrows the caller-supplied-DN path to loopback `CN=siclocal` traffic only, binds remote callers to their authenticated peer certificate DN regardless of what they supply, and rejects a mismatch with an explicit logged error ([Rapid7 Labs, 2026-07-28](https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232)). The operationally consequential sentence is about configuration, not code: Rapid7 states exploitation needs network access to the Management Server plus a Trusted Clients configuration that does not restrict GUI clients, and that this was a default setting in its testing ([Rapid7 Labs, 2026-07-28](https://www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232)). That sits in direct tension with the vendor's own framing recorded in the original entry, where Check Point describes the flaw as affecting only a very specific configuration. The two positions are not reconcilable from the public record, and the difference decides how much of an estate is in scope: on Rapid7's reading an unpatched management server is exploitable as shipped, on Check Point's it is exploitable only where the configuration departs from the norm. A defender sizing exposure should plan against the former and verify the Trusted Clients setting directly rather than assuming either. Detection, for that retrospective question: the patched build logs a rejection when a supplied DN does not match the authenticated certificate DN, so on patched servers that log line is a direct attempt indicator; on servers that were unpatched during the window, the telemetry to reconstruct from is the management server's own administrator audit trail — a full-administrator session, and any policy or configuration change it made, that cannot be tied to a known administrator authenticating from a known client. **Triage:** legitimate SmartConsole administrator sessions originate from your operator workstations and correspond to named accounts your directory can vouch for; the discriminator is an administrator-privileged session whose client address falls outside the Trusted Clients set you intended, or a policy change with no corresponding named-operator login.