CVE-2026-16232: Check Point SmartConsole authentication bypass in login process

CVE-2026-16232 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-07-22

Check Point SmartConsole is a management application used to configure and monitor corporate network security policies. A critical vulnerability allows an unauthorized person to bypass the login process and gain full administrative control over the security infrastructure. This could allow an attacker to disable firewalls, change security rules, or gain access to sensitive internal network traffic. Check Point has confirmed that this flaw is currently being exploited in the wild.

Technologies: Check Point Quantum Security Management. Vendors: Check Point.

Quick answers

Is CVE-2026-16232 exploited in the wild?
Yes. CVE-2026-16232 is known to be exploited in the wild, first recorded on 22 July 2026. Treat it as urgent.
How severe is CVE-2026-16232?
Critical severity, with a CVSS score of 9.8, published 22 July 2026.
Which products and versions are affected?
Check Point Multi-Domain Security Management R82.10 (Take 36 and below), R82 (Take 118 and below), R81.20 (Take 158 and below), R81.10, R81, R80.40, R80.30, R80.20, R80.10, R80, R77.30, R82.10 Take 36 and below; R82 Take 118 and below; R81.20 Take 158 and below; R81.10, R81, R80.x, R77.30; Check Point Quantum Security Management R82.10 (Take 36 and below), R82 (Take 118 and below), R81.20 (Take 158 and below), R81.10, R81, R80.40, R80.30, R80.20, R80.10, R80, R77.30, R82.10 Take 36 and below; R82 Take 118 and below; R81.20 Take 158 and below; R81.10, R81, R80.x, R77.30; Check Point Smartconsole All versions used with affected Management Servers.
Is there a fix for CVE-2026-16232?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-16232 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-16232?
Check whether you run Check Point Multi-Domain Security Management, Check Point Quantum Security Management or Check Point Smartconsole at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability (CWE-287) exists in the Check Point SmartConsole login process. The flaw allows a remote, unauthenticated attacker to intercept or generate a valid application login token. With this token, the attacker can authenticate to the Management Server with full administrative privileges. Exploitation requires the Management Server's IP to be reachable over the network and a configuration that does not restrict 'Trusted Clients.' Check Point reports active exploitation of this vulnerability. Users should apply the latest Jumbo Hotfix Accumulator for their respective versions (R82.10, R82, R81.20, etc.) to mitigate the risk.

Affected products

  • Check Point Quantum Security Management R82.10 Take 36 and below; R82 Take 118 and below; R81.20 Take 158 and below; R81.10, R81, R80.x, R77.30
  • Check Point Multi-Domain Security Management R82.10 Take 36 and below; R82 Take 118 and below; R81.20 Take 158 and below; R81.10, R81, R80.x, R77.30
  • Check Point SmartConsole All versions used with affected Management Servers

Timeline

  • 2026-07-22: disclosed
  • 2026-07-22: advisory
  • 2026-07-22: exploited: Confirmed active exploitation in the wild at time of disclosure.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.