Authentication Bypass in Check Point SmartConsole Grants Full Admin Access
CISA: Check Point SmartConsole Improper Authentication Vulnerability
CVSS 4.0
9.3critical
EPSS
72%p99
Published
()
KEV added
AI analysis
Check Point SmartConsole, the administrative client used to manage Quantum Security Management and Multi-Domain Security Management, contains an authentication bypass (CWE-287) in its login process that allows an unauthenticated remote attacker to obtain an application login token and authenticate with full administrative privileges. Exploitation is possible when the Management Server IP address is reachable from the internet and the configuration does not restrict Trusted Clients. A successful attacker can modify security policies and security configurations, effectively taking control of firewall management. Any organization running an internet-exposed Check Point management server without Trusted Client restrictions is affected, though Check Point reports exploitation has impacted only a very small number of customers. The flaw was added to CISA's KEV on 2026-07-22, is actively exploited, and press reports indicate public proof-of-concept code has been released.
What to do: Apply the fix released in Check Point's advisory for CVE-2026-16232 by updating SmartConsole and the associated Quantum/MDS management software; no fixed version numbers were provided in this data, so confirm them against the vendor bulletin. As an interim mitigation, restrict internet access to the Management Server IP address and configure Trusted Clients so SmartConsole connections are accepted only from known administrator addresses. Review management logs for unexpected logins, unauthenticated token issuance, or unfamiliar administrator sessions, and complete remediation per CISA BOD 26-04 given the KEV listing.
Affected
Check Point SmartConsole
—
Check Point Quantum Security Management
—
Check Point Multi-Domain Security Management
—
Estimated exposure
largeplausibly tens of thousands of Check Point management deployments, though the vulnerable subset is only those with an internet-exposed Management Server and no… — SmartConsole is the standard admin client across Check Point's large Quantum/MDS installed base, but only internet-exposed management servers lacking Trusted Client restrictions are exploitable, and Check Point states only a very small…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
CISA Known Exploited Vulnerability
Affected
Check Point SmartConsole
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Attackers exploit Check Point SmartConsole authentication bypass CVE-2026-16232 to take over Quantum Security Management firewall servers; CISA added it to KEV.
CVE-2026-16232 is an authentication bypass (CWE-287) in the SmartConsole login process of Check Point Quantum Security Management, exploitable via an application token. Disclosed July 22, 2026, it was added to CISA's Known Exploited Vulnerabilities catalog the same day with remediation due July 25. Rapid7, Check Point Research and other vendors confirmed exploitation in the wild, and a public PoC was released. A workaround is available, and federal agencies must comply with BOD 26-04 patching guidance.
Check Point SmartConsole authentication bypass CVE-2026-16232 grants unauthenticated attackers full admin access; actively exploited and added to CISA KEV.
CVE-2026-16232 is an improper authentication flaw (CWE-287) in the Check Point SmartConsole login process that lets an unauthenticated remote attacker obtain an application token and authenticate with full administrative privileges. Exploitation requires the Management Server to be internet-reachable and the Trusted Clients list not restricted to specific administrator addresses. Check Point confirmed active exploitation affecting a small number of customers, and the vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog. A hotfix is available via Check Point advisory sk185169.
Check Point patched two 9.8-rated VPN certificate flaws, CVE-2026-85102 and CVE-2026-85103, enabling unauthenticated remote code execution; no exploitation observed yet.
Check Point disclosed and began patching two critical (CVSS 9.8) vulnerabilities in VPN certificate handling on September 9: CVE-2026-85102, a certificate trust validation failure in VPN negotiation on Security Gateways, and CVE-2026-85103, a heap-based buffer overflow in ASN.1 decoding affecting Quantum Security Gateways and Security Management Server. Affected branches include R81.20, R82, and R82.10 Jumbo Hotfix levels; fixes ship via Live Patch or the latest Jumbo Hotfix. The company found both internally and reports no evidence of exploitation; the Canadian Centre for Cyber Security also published an advisory listing Spark firewalls.
Check Point patches two critical unauthenticated RCE flaws (CVE-2026-85102, CVE-2026-85103) in VPN gateways and firewalls; no exploitation observed.
Check Point released patches for CVE-2026-85102 and CVE-2026-85103, two critical vulnerabilities (CVSS 9.8) enabling unauthenticated remote code execution in products using VPN functionality. CVE-2026-85102 involves improper validation of certificate data during VPN negotiation, while CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoding flow. Updates cover versions R82.10, R82, and R81.20; manually defining VPN rules is offered as a mitigation, though it does not apply to locally managed Spark Firewall instances. Check Point discovered both flaws internally and reports no evidence of exploitation in the wild.
Check Point issued a high-severity alert for CVE-2026-16232, an authentication bypass in the SmartConsole login process via application token.
Check Point published support article sk185169 describing CVE-2026-16232, an authentication bypass affecting the SmartConsole login process when using application tokens. The vendor rates the issue High. The brief advisory text provides no exploitation details, CVSS score, or affected-version list.