CVE-2026-16232criticalunder attackCWE-287

CVE-2026-16232: critical vulnerability in checkpoint Multi-Domain Security Management

Authentication Bypass in the SmartConsole Login Process Using an Application Token

Published · Updated

Follow this CVE+ Monitor Quantum Security Management+ Monitor Multi-Domain Security Management

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

93Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.

ssvc Actcvss 9.3epss 3.5%
from disclosure to weaponsame day
Published on NVDJul 22
1st PoCJul 22
metasploitJul 22
CISA KEVJul 22
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CISC Gov.br · 28 Jul 2026Boletim do CISC de Vulnerabilidaderead on gov.br ↗
  • CTIR Gov · ALERTA 66/2026 · 24 Jul 2026Vulnerabilidade crítica que afeta o SmartConsoleread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2026-07-25

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

In short

An unauthenticated attacker can bypass the login process in Check Point SmartConsole and obtain an administrative token, allowing full control over security policies without needing valid credentials.

Technical detail

CWE-287 authentication bypass in SmartConsole's login process allows remote unauthenticated attackers to directly obtain application tokens with administrative privileges. Exploitation requires network access to the Management Server IP and requires that Trusted Clients restrictions are not configured; successful exploitation grants full modification rights to security policies and configurations.

Summary generated and translated by AI from the official description.
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
checkpoint · Multi-Domain Security Managementcheckpoint · Quantum Security Management
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — checkpoint Multi-Domain Security Management

In the same product, most dangerous first.

CVE-2026-93616CRITICALDirectory Traversal and File upload allows execution of arbitrary script on the Management ServerEPSS 91.6%KEVCVE-2026-85103CRITICALHeap-based Buffer Overflow in VPN Certificate ASN.1 DecodingEPSS 4.3%CVE-2026-48136MEDIUMAuthenticated Administrator Role-Based Access Control Bypass in ComplianceEPSS 3.7%CVE-2026-62144CRITICALManagement Authentication Bypass and Privilege EscalationEPSS 1.0%CVE-2026-91843CRITICALStack overflow in login process to the Security Management and Log ServersEPSS 0.5%CVE-2026-62145HIGHLocal Privilege Escalation in Gaia PortalEPSS 0.4%