Advisory · CVE-2026-16232
Check Point SmartConsole auth bypass hands out admin tokens
An unauthenticated attacker can obtain an application login token from an internet-exposed Check Point Management Server and log in via SmartConsole with full administrative privileges.
- Vendor
- Check Point
- Product
- SmartConsole
- Identifier / CWE
- CVE-2026-16232
CWE-287 - Action timing
- Aug 12, 2026
Explain it like I’m five
The guard office for your firewalls hands out master keys to anyone who knocks in a special way, without checking ID. Attackers learned the knock and can walk in as the boss.
- 01Find the management server
The attacker locates a Check Point Management Server reachable from the internet with Trusted Clients unrestricted.
- 02Request an app token
The attacker abuses the SmartConsole login process to obtain a valid application login token, with no credentials.
- 03Log in as admin
The token is used to authenticate to SmartConsole with full administrative privileges.
- 04Rewrite the defenses
The attacker can modify security policies, gateway configuration, and administrative accounts.
What happened
Check Point’s SmartConsole login process contains an authentication bypass. An unauthenticated remote attacker can obtain an application login token and use it to log in to SmartConsole with full administrative privileges, then change security policies and security configurations. Exploitation requires the Management Server to be reachable from the internet and a configuration that does not restrict Trusted Clients (GUI clients). Affected products are Security Management Server and Multi-Domain Security Management Server, versions R77.30 through R82.10. Check Point states it is aware of active exploitation affecting a very small number of customers, and published indicators of compromise including the attacker IPs 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, and 139.28.37.250. The fix shipped in the Jumbo Hotfix released July 22, 2026.
What to do
- Install the July 22, 2026 Jumbo Hotfix on all Security Management and Multi-Domain Management servers, and confirm the running hotfix take is newer than the affected builds.
- Restrict Trusted Clients to authorized administrative IP addresses or tightly controlled management subnets; do not use “Any” as the trusted client type.
- Remove direct internet exposure of Management Servers and Gaia portals; put management access behind firewall rules and verify implied rules for control connections are enabled.
- Hunt for compromise: in SmartConsole Logs and Audit Logs, search for the published attacker IPs and for logins with authentication method “application token”.
- Review recent administrator sessions, policy changes, API users, and gateway configuration changes; where compromise is suspected, revoke application tokens, reset admin credentials, and invalidate sessions.
Management note
This is a worst-case management-plane flaw: the system that enforces your firewall policy can be taken over without a password, and it is already being exploited. The saving grace is that it only works against management servers exposed to the internet without client restrictions, so this is also a straightforward architecture fix. Treat internet-facing management as the emergency and the hotfix as the cure.