Loading story…
Check Point disclosed CVE-2026-16232, a high-severity SmartConsole authentication bypass affecting Security Management, Multi-Domain Management, Firewall, and Multi-Domain Log Server products across multiple versions. The flaw, rated CVSS 9.3, allows attackers to bypass SmartConsole login using an application token, and Check Point said it has already been exploited against a small number of customers with specific exposed configurations.
Check Point released fixes for CVE-2026-16232 along with related flaws CVE-2026-62144 and CVE-2026-62145, while the Canadian Centre for Cyber Security issued advisory AV26-735 urging organizations to review the vendor guidance and apply mitigations. The highest risk is for management interfaces exposed directly to the internet without IP restrictions, and defenders were advised to install the available jumbo hotfix, restrict trusted GUI clients by IP address, and place management access behind a firewall until patching is complete.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Rapid7 published a technical analysis of CVE-2026-16232 describing the root cause as a trust-boundary failure in SmartConsole authentication, and showed how unauthenticated access to TCP 18190 and TCP 19009 could be chained to obtain full administrator access. The company said it reproduced the issue on R81.20 and R82.10 and confirmed that Check Point's patched code in R81.20 Jumbo Hotfix Take 158 blocks the proof-of-concept exploit.
Check Point published attacker IP addresses tied to exploitation of CVE-2026-16232 and advised customers to review logs for suspicious connections while applying the July 22 Jumbo hotfix and restricting management access. The company also said affected organizations had already been notified.
CISA issued an urgent warning on CVE-2026-16232, describing the Check Point authentication flaw as actively exploited in the wild, and added it to the Known Exploited Vulnerabilities catalog. The notice reinforced Check Point's guidance to apply the July 22 Jumbo Hotfix and restrict internet exposure of management interfaces.
On 2026-07-22, the Canadian Centre for Cyber Security issued advisory AV26-735 about Check Point's security update. The notice highlighted CVE-2026-16232 as actively exploited and urged administrators to review Check Point's advisories and apply mitigations.
On 2026-07-22, Check Point disclosed CVE-2026-16232, a high-severity SmartConsole authentication bypass affecting Check Point Management products, and said it had been exploited in the wild against a small number of customers with specific exposed configurations. Check Point also released a jumbo hotfix and patched related flaws CVE-2026-62144 and CVE-2026-62145.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
24 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethehackernews.com
Open sourcerapid7.com
Open sourcegithub.com
Open sourceblog.checkpoint.com
Open sourcelabs.beazley.security
Open sourcecve.org
Open sourcecwe.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point released fixes for **CVE-2026-18574**, a critical authentication-bypass flaw in **Security Management Server** and **Multi-Domain Security Management Server (MDS)** that can let an unauthenticated remote attacker with network access to management services execute arbitrary commands. The vulnerability carries a **CVSS 4.0 score of 9.3** and is classified as **`CWE-288`**, with impact that can extend to full compromise of the security management environment. Check Point said it discovered the issue internally and reported no evidence of active exploitation, while noting that **Smart-1 Cloud** customers are already protected. Supported affected versions include **R81.20, R82, and R82.10**, with older affected releases from **R80 through R81.10** now end-of-support; fixes were issued through **Jumbo Hotfix Accumulator** updates. The company urged customers to apply patches, restrict **Trusted Clients**, limit management access to trusted administrator systems, avoid exposing management interfaces to untrusted networks or the public internet, and monitor for unauthorized activity.
Aug 8, 2026
CISA added **CVE-2026-16232** to its Known Exploited Vulnerabilities catalog after reports of active exploitation against **Check Point SmartConsole**. The flaw, mapped to **`CWE-287` Improper Authentication**, affects Check Point Quantum Security Management and Multi-Domain Security Management and allows an unauthenticated remote attacker to obtain an application login token and authenticate with **full administrative privileges**. Check Point said the issue has affected a very small number of customers, while CISA set a **2026-07-25** remediation deadline under **BOD 26-04** and directed organizations to apply vendor mitigations and conduct forensics triage. Successful exploitation can let attackers modify security policies and configurations, and remote attacks are possible when the Management Server is reachable and Trusted Clients restrictions are not in place. CISA’s broader KEV update also added **CVE-2026-50522** affecting Microsoft SharePoint, bringing the catalog total to 1,653 entries.
Jul 23, 2026
Check Point released security updates to fix multiple vulnerabilities across **Mobile Access**, **SSL VPN**, **Remote Access VPN**, **Spark Firewall**, **Security Gateways**, and **Multi-Domain Security Management**. The most severe flaw, **`CVE-2026-50751`** with a **CVSS 9.3**, is an authentication bypass issue in deprecated **IKEv1** key exchange used for VPN Remote Access and Mobile Access, and Check Point said it is being exploited in the wild as a **zero-day**. The update also addresses **`CVE-2026-50752`**, which affects certificate validation in deprecated **IKEv1** site-to-site VPN connections and could allow **man-in-the-middle** attacks. Across the broader set of flaws, Check Point warned of risks including **denial of service, data manipulation, authentication bypass, and unauthorized access**, and urged organizations to apply patches as soon as testing is complete.
Jul 10, 2026