CVE-2026-16232: Check Point SmartConsole Auth Bypass
Found by web discovery while looking for coverage of CVE-2026-16232
Check Point SmartConsole authentication bypass CVE-2026-16232 grants unauthenticated attackers full admin access; actively exploited and added to CISA KEV.
CVE-2026-16232 is an improper authentication flaw (CWE-287) in the Check Point SmartConsole login process that lets an unauthenticated remote attacker obtain an application token and authenticate with full administrative privileges. Exploitation requires the Management Server to be internet-reachable and the Trusted Clients list not restricted to specific administrator addresses. Check Point confirmed active exploitation affecting a small number of customers, and the vulnerability has been added to the CISA Known Exploited Vulnerabilities catalog. A hotfix is available via Check Point advisory sk185169.
- Unauthenticated token issuance enables full admin access to Check Point Management Servers
- Exploitation requires internet exposure and unrestricted Trusted Clients configuration
- Attackers can modify firewall policies and security configurations on the management plane
- Fix available in sk185169 hotfix; Trusted Clients restriction serves as workaround
- Listed in CISA KEV, imposing remediation deadlines for US federal agencies
- CVEs
- CVE-2026-16232
- Vendors
- Check Point
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-16232 | Authentication Bypass in Check Point SmartConsole Grants Full Admin Access | 9.3 | 4% | KEV | KEV |
From the original article
4 min read at sentinelone.com
CVE-2026-16232 is an authentication bypass vulnerability in Check Point SmartConsole. Learn about its impact, affected versions, and mitigation methods.
sentinelone.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.