---
title: "Check Point CVE-2026-16232: Exploited Management Auth Bypass"
url: https://erroneo.us/security/briefs/check-point-smartconsole-cve-2026-16232-auth-bypass/
description: "Unauthenticated admin login to Check Point Security Management via a SmartConsole app token, exploited. Fixed in R82.10/R82/R81.20 Jumbo Hotfixes. Patch."
type: security-brief
section: "Security Digest"
date_published: 2026-07-22
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2026-16232"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Check Point CVE-2026-16232: Exploited Management Auth Bypass

**Verdict: Patch this week.** Install the July 2026 Jumbo Hotfix on every Check Point management server this week, and today if the server is reachable from the internet with unrestricted Trusted Clients; that is the setup attackers used to take full admin control.

- **Who must act:** Anyone running an on-premises Check Point Security Management Server or Multi-Domain Server on R82.10, R82, R81.20 or older, above all where the management IP is internet-reachable and Trusted Clients allows Any.
- **Who can relax:** Smart-1 Cloud customers, whom Check Point says are already protected; teams whose management servers run the fixed Jumbo Hotfix takes; and gateways themselves, which this CVE does not affect.
- **Affected:** Security Management and Multi-Domain Security Management R82.10 with Jumbo Hotfix Take 36 or below (per the CVE record); R82 with Jumbo Hotfix Take 118 or below (per the CVE record); R81.20 with Jumbo Hotfix Take 158 or below (per the CVE record); R81.10, R81, R80.30, R80.20, R80.10, R80 and R77.30 (end of support, no fix)
- **Fixed:** R82.10 Jumbo Hotfix Accumulator from Take 36 (sk185169; install the latest take); R82 Jumbo Hotfix Accumulator from Take 118 (sk185169; install the latest take); R81.20 Jumbo Hotfix Accumulator from Take 158 (sk185169; install the latest take); Smart-1 Cloud: protected by Check Point
- **CVEs:** CVE-2026-16232
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the version and Jumbo Hotfix take on every Security Management and Multi-Domain server (cpinfo -y all).
2. Install the latest Jumbo Hotfix take for R82.10, R82 or R81.20 through CPUSE, including standby and secondary management servers.
3. Restrict Trusted Clients to named admin IPs or subnets (Manage & Settings > Permissions & Administrators > Trusted Clients); never use Any.
4. Firewall the management server so only trusted admin addresses can reach it, and keep implied rules for control connections enabled.
5. Upgrade any management server still on R81.10 or older, since end-of-support versions get no fix.
6. If the server was internet-reachable, review audit logs and policy changes, and rotate administrator credentials.

### How to check if you are affected

- In SmartConsole Logs & Monitor, search audit logs for 'Authentication method: application token' and 'Password based application token', and investigate unknown admin names or source IPs.
- Search logs for the attacker IPs Check Point published: 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, 139.28.37.250 and 194.213.18.137 (relevant to events before Jul 23, 2026).
- Review policy installs, new administrators, VPN and logging configuration changes made since April 2026.

## What happened

On July 22, 2026, Check Point published [sk185169](https://support.checkpoint.com/results/sk/sk185169/) and a [blog advisory](https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232/) with Jumbo Hotfixes for three bugs found "during a routine BLAST review." One of them, CVE-2026-16232, was already being exploited, "affecting a handful of customers." The [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-16232) describes it as an authentication bypass in the SmartConsole login process. It allows "an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges." From there, the attacker can change security policy and configuration. Check Point scores it CVSS 4.0 9.3, and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-16232) rates it CVSS 3.1 9.8. CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232) the same day, with a federal deadline of July 25.

The same hotfixes fix two related bugs that are not known to be exploited. CVE-2026-62144 (CVSS 9.3) is a management authentication bypass with privilege escalation. CVE-2026-62145 (CVSS 7.5) is a local privilege escalation in the Gaia WebUI on gateways. The attacks may predate the fix by months. [Help Net Security](https://www.helpnetsecurity.com/2026/07/23/check-point-vulnerability-cve-2026-16232/) reports that deception firm Lupovis saw honeypot activity on April 29, 2026 consistent with automated exploitation of CVE-2026-16232 or CVE-2026-62144. The activity probed Management API endpoints, including `login` and `show-gateways-and-servers`. [Rapid7](https://www.rapid7.com/blog/post/etr-cve-2026-16232-critical-check-point-smartconsole-authentication-bypass-exploited-in-the-wild/) published a root-cause analysis on July 28.

## Who is affected

On-premises Security Management Servers and Multi-Domain Security Management servers are affected. Gateways are not affected by this CVE. The fixes are Jumbo Hotfix Accumulator takes for three supported versions: R82.10 from Take 36, R82 from Take 118 and R81.20 from Take 158. Check Point lists R81.10 and R81 as end of support and gives no fix for them, and the CVE record also lists R80.x and R77.30 as affected. One discrepancy: the CVE record lists "Take 36 or below" (and 118 or below, 158 or below) as affected, while sk185169 says the fix is included "starting from" those takes. Install the latest take and the question goes away. Check Point says Smart-1 Cloud customers "are already protected."

Remote exploitation needs two conditions: internet access to the Management Server IP, and a Trusted Clients setting that does not restrict which hosts may connect with SmartConsole.

## Do you really need to act?

Yes, but how fast depends on your configuration. A management server controls policy for every gateway it manages. Admin access there lets an attacker open firewall rules, change VPN settings or switch off logging across the estate.

- **Management reachable from the internet, Trusted Clients set to Any:** this is the exploited setup. Patch today and investigate, starting with the audit-log checks below.
- **Management restricted to admin networks:** patch this week. As a CheckMates contributor quoted by Help Net put it, "Network restrictions reduce exposure, but they do not remove the vulnerable code."
- **R81.10 or older:** there is no fix. Restrict access now and plan the upgrade.
- **Smart-1 Cloud:** no action needed for this CVE.

## What to do now

1. On each management server, run `cpinfo -y all` in expert mode to see the version and installed Jumbo take.
2. Install the latest Jumbo Hotfix take for R82.10, R82 or R81.20 through CPUSE. Do the same on secondary and standby management servers and Multi-Domain Servers.
3. In SmartConsole, open **Manage & Settings > Permissions & Administrators > Trusted Clients** and replace any `Any` entry with named admin IPs or subnets.
4. Put the management server behind a firewall rule that admits only trusted admin addresses, and confirm that implied rules for control connections stay enabled.
5. If the server was exposed, rotate administrator passwords and API keys, and remove administrator accounts nobody recognizes.

## How to tell if you were hit

Check Point gives specific checks in sk185169. In SmartConsole **Logs & Monitor**, open the Audit Logs view and search for `Authentication method: application token` and `Authentication method: Password based application token`. Treat every hit as suspicious, and look for administrator names or source IPs you don't recognize. Search logs for the six attacker addresses Check Point published: `151.241.99.207`, `151.241.99.233`, `158.62.198.182`, `192.142.10.99`, `139.28.37.250` and `194.213.18.137`. Check Point marks that list as relevant to events before July 23. Its absence does not prove you are clean. Review policy installs, new administrators, and VPN or logging changes back to at least April 2026.

## Timeline

- Apr 29, 2026 — Lupovis honeypots record activity consistent with exploitation of this flaw or CVE-2026-62144, per Help Net Security.
- Jul 19, 2026 — Check Point creates sk185169, and the CVE is reserved.
- Jul 22, 2026 — Check Point publishes the advisory and Jumbo Hotfixes. CISA adds the CVE to KEV.
- Jul 25, 2026 — CISA's remediation deadline for federal agencies.
- Jul 28, 2026 — Rapid7 publishes a root-cause analysis.
- Sep 24, 2026 — sk185169 last modified.

## Sources

1. [Check Point — sk185169: CVE-2026-16232 Authentication bypass with SmartConsole login process using application token](https://support.checkpoint.com/results/sk/sk185169/)
2. [Check Point Blog — Security Advisory: Active exploitation of SmartConsole authentication bypass (CVE-2026-16232)](https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232/)
3. [CVE record — CVE-2026-16232](https://www.cve.org/CVERecord?id=CVE-2026-16232)
4. [NVD — CVE-2026-16232](https://nvd.nist.gov/vuln/detail/CVE-2026-16232)
5. [CISA — Known Exploited Vulnerabilities: CVE-2026-16232](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232)
6. [Rapid7 — CVE-2026-16232: Critical Check Point SmartConsole authentication bypass exploited in the wild](https://www.rapid7.com/blog/post/etr-cve-2026-16232-critical-check-point-smartconsole-authentication-bypass-exploited-in-the-wild/)
7. [Help Net Security — Attackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232)](https://www.helpnetsecurity.com/2026/07/23/check-point-vulnerability-cve-2026-16232/)

---
Source page: https://erroneo.us/security/briefs/check-point-smartconsole-cve-2026-16232-auth-bypass/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt