CVE-2026-16232: Check Point SmartConsole — Admin Bypass, Active Exploitation (July 2026)

CVE-2026-16232 — Check Point SmartConsole

CVE-2026-16232 is a critical authentication bypass vulnerability (CVSS 9.3) affecting Check Point Security Management and Multi-Domain Management, allowing unauthenticated remote attackers to gain full administrative access. This flaw is under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities catalog.

Attack Vector

Attackers remotely target internet-exposed Check Point management servers lacking strict IP restrictions. By exploiting the authentication bypass, they gain admin privileges without credentials. Observed malicious activity originates from IPs including 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, 139.28.37.250, and 194.213.18.137. Successful exploitation enables attackers to modify security policies, execute privileged commands, and escalate privileges across managed environments.

Who Is at Risk

All organizations running Check Point Security Management or Multi-Domain Management products with SmartConsole exposed to the internet are at risk, especially those without proper IP-based access controls. The vulnerability impacts global deployments; exploitation has been confirmed in the wild. Additional vulnerabilities, CVE-2026-62144 and CVE-2026-62145, were also patched and should be addressed.

Patch & Mitigate

• Patch: Apply the latest Check Point hotfixes for Security Management and Multi-Domain Management immediately. CISA mandates federal agencies remediate CVE-2026-16232 without delay.
• Workaround: Restrict SmartConsole and management server access to trusted IP ranges only; remove direct internet exposure where possible.
• Detect: Monitor logs for unauthorized admin logins, especially from the listed IOCs. Investigate any policy changes or suspicious administrative activity.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit exposed management interfaces to gain entry.
• TA0003 — Persistence: Gained admin access allows for creation of new privileged accounts or backdoors.
• TA0005 — Defense Evasion: Attackers may modify security policies to evade detection and maintain access.

Source: https://thehackernews.com/2026/07/check-point-patches-exploited.html