A critical authentication bypass vulnerability affecting Check Point SmartConsole has been actively exploited in the wild, allowing attackers to gain unauthorized access to security management systems under specific configurations.
The flaw, tracked as CVE-2026-16232, carries a CVSS score of 9.3 and impacts Check Point Security Management and Multi-Domain Management deployments, particularly when management interfaces are exposed directly to the internet without proper IP restrictions.
Critical Check Point SmartConsole Flaw
According to Check Point’s July 2026 security advisory, the issue was identified during an internal BLAST (Building, Learning, and Securing Technology) review, with limited real-world exploitation observed targeting a small number of organizations.
The vulnerability enables authentication bypass through improper validation of application tokens during SmartConsole login, effectively allowing attackers to impersonate legitimate users without valid credentials.
This type of access could lead to full administrative control over security policies, firewall rules, and network configurations, significantly increasing the risk of lateral movement and persistence within enterprise environments.
Check Point confirmed that only customers with misconfigured management exposure were affected, while Smart-1 Cloud deployments remain protected by default architecture controls.
In addition to CVE-2026-16232, Check Point disclosed two other high-severity vulnerabilities: CVE-2026-62144, another authentication bypass combined with privilege escalation (CVSS 9.3), and CVE-2026-62145, a local privilege escalation flaw in GaiaOS WebUI (CVSS 7.5).
While these vulnerabilities have not been observed in active exploitation, their presence underscores broader risks associated with management plane exposure and insufficient access controls. All identified issues affect versions R81.10, R81.20, R82, and R82.10, including older unsupported releases.
Threat intelligence data shared by Check Point includes several IP addresses linked to observed exploitation attempts, suggesting targeted scanning and opportunistic attacks against exposed management interfaces. Security teams are advised to immediately review logs and network telemetry for suspicious connections originating from these indicators.
IOC Details:
IP Address
151.241.99[.]207
151.241.99[.]233
158.62.198[.]182
192.142.10[.]99
139.28.37[.]250
194.213.18[.]137Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
To mitigate the risk, Check Point strongly recommends applying the latest jumbo hotfix, which includes security hardening updates addressing these vulnerabilities.
Organizations should restrict SmartConsole and management access to trusted IP addresses only, enforce network-level segmentation, and ensure that firewall rules governing control connections are properly configured. Disabling direct internet exposure of management interfaces is critical to preventing exploitation.
This incident highlights a recurring security challenge: the exposure of critical management infrastructure to untrusted networks. Even highly secure platforms can become vulnerable when deployed without adherence to best practices.
The discovery and rapid patching of this flaw demonstrate the importance of proactive security programs like BLASTand reinforce the need for organisations to continuously audit configurations, enforce least-privilege access, and monitor for anomalous activity across management planes.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
