Loading vulnerability…
CVE-2026-16232 is a critical improper authentication vulnerability in the Check Point SmartConsole login process affecting Check Point Security Management Server and Multi-Domain Security Management Server. The flaw allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate to SmartConsole with full administrative privileges. Technical analysis indicates the issue stems from a broken trust boundary in remote application authentication: the server accepts an attacker-supplied Secure Internal Communication distinguished name instead of binding the asserted identity to the authenticated peer certificate identity. By abusing the legacy management authentication flow to mint an application token and then redeeming a SmartConsole single sign-on ticket through the management API, an attacker can establish a fully privileged administrative session. The vulnerability has been reported as actively exploited in the wild, including as a zero-day prior to patch availability.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This repository is a compact single-file Python proof-of-concept exploit for CVE-2026-16232 affecting Check Point management products. The repo contains one executable script (`CVE-2026-16232.py`), a README describing the vulnerability and usage, and a license file. The Python code uses only the standard library (`socket`, `ssl`, `struct`, `urllib`, `xml.etree`, `argparse`, `re`) and is clearly intended as a working exploit rather than a detector. The exploit chain is network-based and targets two management interfaces on the remote Check Point server: the legacy SIC/CPMI service on TCP/18190 and the CPM SOAP service on TCP/19009. Its core capability is to turn an unauthenticated connection into an authenticated SmartConsole administrator session. According to the code comments and README, the vulnerability exists because the server accepts an attacker-controlled SIC distinguished name (`:DN`) during `:certificate_bind` instead of binding identity to the authenticated TLS client certificate. The script first interacts with SIC bootstrap/CPMI logic, reconstructing vendor-specific FwSet/Huffman-encoded messages and DER-encoded subject data to impersonate the management server’s own SIC DN. After a successful application bind, it obtains an application DLE token. The script then demonstrates post-auth capabilities in stages. First, it uses the raw application token to call a protected SOAP API (`getServerInfo`) and prints fields such as hostname, IP address, OS name, and OS version. It also queries `GetAllAdmins` and notes that the raw application token may not expose administrator records. Next, it sends a CPMI command with subject `gen-sso-token` to mint a SmartConsole SSO ticket, explicitly requesting full permissions via `ffffffff|ffffffff|ffffffff` and using the SmartConsole lower name `system_admin`. It extracts the 64-hex-character SSO token from the reply, redeems it through the CPM SOAP service, and obtains a SmartConsole session (`sid` / `client_sid`). Finally, it re-runs the admin query and prints administrator names and authentication methods, proving privilege escalation to a full SmartConsole administrative context. Overall, this is an operational exploit PoC with a hardcoded privilege-escalation flow and no external framework dependency. It is not merely a detection script: it performs the full attack path from unauthenticated access to privileged session creation and privileged data enumeration.
Repository contains a single Python proof-of-concept exploit and a short README. The main file, CVE-2026-16232.py, is a standalone unauthenticated network exploit for Check Point CVE-2026-16232. Its purpose is to demonstrate that a vulnerable management server incorrectly trusts a client-supplied SIC distinguished name during certificate binding, allowing an attacker to impersonate the server's own SIC identity and bootstrap an application session. Structurally, the script includes low-level helpers for Check Point proprietary protocol handling: Huffman/FwSet serialization routines, SIC framing, DER encoding helpers for certificate subject construction, and logic to encode the CRL/SIC subject atom. It then uses these primitives to talk to the legacy SIC/CPMI service, obtain an application DLE token, and verify limited access by calling getServerInfo. After that, it sends a CPMI command subject gen-sso-token to FWM on TCP/18190, requesting a SmartConsole SSO token with hardcoded full permission bits ("ffffffff|ffffffff|ffffffff") and SmartConsole identity metadata using lower_name system_admin. The script extracts the 64-hex-character SSO token from the reply, redeems it against the CPM service on TCP/19009, and establishes a SmartConsole session. The exploit's main capability is authentication bypass leading to administrative session creation. It demonstrates privilege expansion by comparing GetAllAdmins results before and after SSO redemption: the raw application token has limited visibility, while the redeemed SmartConsole session can enumerate administrator records and authentication methods. This is an operational PoC rather than a mere detector because it performs the full attack chain and yields a usable privileged session context, though it is still a standalone script rather than a framework-integrated or highly customizable weaponized exploit.
This repository is a small, focused proof-of-concept for CVE-2026-16232 and contains only two files: a Python exploit script (CVE-2026-16232.py) and a README with usage examples. The Python file is the sole entry point and implements the full exploit chain rather than mere detection. The exploit targets Check Point Security Management Server / MDS over the network. It connects unauthenticated to the legacy SIC/CPMI service on TCP 18190, abuses the vulnerable certificate_bind behavior by supplying the management server's own SIC distinguished name, and obtains an application DLE token. The script then uses the CPM SOAP service on TCP 19009 to call protected APIs, first proving limited access with getServerInfo and then demonstrating privilege escalation by requesting FWM to generate a SmartConsole SSO token via the gen-sso-token CPMI command. The request explicitly asks for SmartConsole permissions set to "ffffffff|ffffffff|ffffffff", after which the script redeems the ticket and queries GetAllAdmins to show that the resulting SmartConsole session has administrator-level visibility. Structurally, the script includes helper routines for Check Point-specific protocol handling: Huffman/FwSet serialization, SIC framing, DER encoding of certificate subject fields, and XML SOAP parsing. This indicates the author reimplemented enough of the proprietary protocol to perform the bind and token workflow directly. The README confirms expected behavior on vulnerable versus patched targets and shows the exploit's end result: authentication bypass leading to a SmartConsole administrator session and enumeration of admin accounts. Overall, this is an operational network exploit PoC for unauthenticated auth bypass and privilege escalation within Check Point management infrastructure.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
207 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability affecting Check Point Security Management.
A vulnerability in the Check Point Security Management platform.
A Check Point SmartConsole vulnerability listed among vulnerabilities actively exploited or operationally weaponized in July 2026.
A vulnerability in Check Point Security Management.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.