Check Point CVE-2026-16232: Exploited Management Auth Bypass

What to do

1. Check the version and Jumbo Hotfix take on every Security Management and Multi-Domain server (cpinfo -y all).
2. Install the latest Jumbo Hotfix take for R82.10, R82 or R81.20 through CPUSE, including standby and secondary management servers.
3. Restrict Trusted Clients to named admin IPs or subnets (Manage & Settings > Permissions & Administrators > Trusted Clients); never use Any.
4. Firewall the management server so only trusted admin addresses can reach it, and keep implied rules for control connections enabled.
5. Upgrade any management server still on R81.10 or older, since end-of-support versions get no fix.
6. If the server was internet-reachable, review audit logs and policy changes, and rotate administrator credentials.

How to check if you are affected or compromised

• In SmartConsole Logs & Monitor, search audit logs for 'Authentication method: application token' and 'Password based application token', and investigate unknown admin names or source IPs.
• Search logs for the attacker IPs Check Point published: 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, 139.28.37.250 and 194.213.18.137 (relevant to events before Jul 23, 2026).
• Review policy installs, new administrators, VPN and logging configuration changes made since April 2026.

What happened#

On July 22, 2026, Check Point published sk185169 and a blog advisory with Jumbo Hotfixes for three bugs found "during a routine BLAST review." One of them, CVE-2026-16232, was already being exploited, "affecting a handful of customers." The CVE record describes it as an authentication bypass in the SmartConsole login process. It allows "an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges." From there, the attacker can change security policy and configuration. Check Point scores it CVSS 4.0 9.3, and NVD rates it CVSS 3.1 9.8. CISA added it to the KEV catalog the same day, with a federal deadline of July 25.

The same hotfixes fix two related bugs that are not known to be exploited. CVE-2026-62144 (CVSS 9.3) is a management authentication bypass with privilege escalation. CVE-2026-62145 (CVSS 7.5) is a local privilege escalation in the Gaia WebUI on gateways. The attacks may predate the fix by months. Help Net Security reports that deception firm Lupovis saw honeypot activity on April 29, 2026 consistent with automated exploitation of CVE-2026-16232 or CVE-2026-62144. The activity probed Management API endpoints, including login and show-gateways-and-servers. Rapid7 published a root-cause analysis on July 28.

Who is affected#

On-premises Security Management Servers and Multi-Domain Security Management servers are affected. Gateways are not affected by this CVE. The fixes are Jumbo Hotfix Accumulator takes for three supported versions: R82.10 from Take 36, R82 from Take 118 and R81.20 from Take 158. Check Point lists R81.10 and R81 as end of support and gives no fix for them, and the CVE record also lists R80.x and R77.30 as affected. One discrepancy: the CVE record lists "Take 36 or below" (and 118 or below, 158 or below) as affected, while sk185169 says the fix is included "starting from" those takes. Install the latest take and the question goes away. Check Point says Smart-1 Cloud customers "are already protected."

Remote exploitation needs two conditions: internet access to the Management Server IP, and a Trusted Clients setting that does not restrict which hosts may connect with SmartConsole.

Do you really need to act?#

Yes, but how fast depends on your configuration. A management server controls policy for every gateway it manages. Admin access there lets an attacker open firewall rules, change VPN settings or switch off logging across the estate.

• Management reachable from the internet, Trusted Clients set to Any: this is the exploited setup. Patch today and investigate, starting with the audit-log checks below.
• Management restricted to admin networks: patch this week. As a CheckMates contributor quoted by Help Net put it, "Network restrictions reduce exposure, but they do not remove the vulnerable code."
• R81.10 or older: there is no fix. Restrict access now and plan the upgrade.
• Smart-1 Cloud: no action needed for this CVE.

What to do now#

1. On each management server, run cpinfo -y all in expert mode to see the version and installed Jumbo take.
2. Install the latest Jumbo Hotfix take for R82.10, R82 or R81.20 through CPUSE. Do the same on secondary and standby management servers and Multi-Domain Servers.
3. In SmartConsole, open Manage & Settings > Permissions & Administrators > Trusted Clients and replace any Any entry with named admin IPs or subnets.
4. Put the management server behind a firewall rule that admits only trusted admin addresses, and confirm that implied rules for control connections stay enabled.
5. If the server was exposed, rotate administrator passwords and API keys, and remove administrator accounts nobody recognizes.

How to tell if you were hit#

Check Point gives specific checks in sk185169. In SmartConsole Logs & Monitor, open the Audit Logs view and search for Authentication method: application token and Authentication method: Password based application token. Treat every hit as suspicious, and look for administrator names or source IPs you don't recognize. Search logs for the six attacker addresses Check Point published: 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, 139.28.37.250 and 194.213.18.137. Check Point marks that list as relevant to events before July 23. Its absence does not prove you are clean. Review policy installs, new administrators, and VPN or logging changes back to at least April 2026.

Timeline#

• Apr 29, 2026 — Lupovis honeypots record activity consistent with exploitation of this flaw or CVE-2026-62144, per Help Net Security.
• Jul 19, 2026 — Check Point creates sk185169, and the CVE is reserved.
• Jul 22, 2026 — Check Point publishes the advisory and Jumbo Hotfixes. CISA adds the CVE to KEV.
• Jul 25, 2026 — CISA's remediation deadline for federal agencies.
• Jul 28, 2026 — Rapid7 publishes a root-cause analysis.
• Sep 24, 2026 — sk185169 last modified.

Vulnerability records

• CVE-2026-16232 · KEV 2026-07-22 · An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Check Point — sk185169: CVE-2026-16232 Authentication bypass with SmartConsole login process using application token support.checkpoint.com
2. Check Point Blog — Security Advisory: Active exploitation of SmartConsole authentication bypass (CVE-2026-16232) blog.checkpoint.com
3. CVE record — CVE-2026-16232 cve.org
4. NVD — CVE-2026-16232 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2026-16232 cisa.gov
6. Rapid7 — CVE-2026-16232: Critical Check Point SmartConsole authentication bypass exploited in the wild rapid7.com

Coverage and analysis

1. Help Net Security — Attackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232) helpnetsecurity.com