Check Point patched CVE-2026-91843 (CVSS 9.8), a pre-authentication stack overflow letting unauthenticated attackers run code as root on Security Management and Log Servers.
Check Point issued a high-severity alert for CVE-2026-16232, an authentication bypass in the SmartConsole login process via application token.
Attackers exploit Check Point SmartConsole authentication bypass CVE-2026-16232 to take over Quantum Security Management firewall servers; CISA added it to KEV.
Check Point SmartConsole authentication bypass CVE-2026-16232 grants unauthenticated attackers full admin access; actively exploited and added to CISA KEV.