# CVE-2026-16232: Check Point SmartConsole Authentication Bypass Actively Exploited, Added to CISA KEV

> A critical authentication bypass (CVSS 9.3) in Check Point Security Management / Multi-Domain Management allows an unauthenticated remote attacker to obtain an administrative application login token via the SmartConsole login process, primarily where management interfaces are exposed directly to the internet without IP-based restrictions. Confirmed under active, limited-scope exploitation and added to CISA's KEV catalog on 2026-07-22; Check Point shipped a Jumbo Hotfix the same day alongside two related, not-yet-exploited CVEs.

- **Published:** 2026-07-23T00:00:00Z
- **Last reviewed:** 2026-08-03T02:31:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1650
- **ID:** TL-2026-1650
- **Severity:** CRITICAL (CVSS 9.3)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 39 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-16232, CVE-2026-62144, CVE-2026-62145

## Description

CVE-2026-16232 is an improper authentication vulnerability (CWE-287) in the SmartConsole login process of Check Point Security Management Server and Multi-Domain Security Management Server (MDS). The flaw allows an unauthenticated remote attacker who can reach the Management Server's network interface to obtain an application login token normally issued only after successful authentication. That token can then be used to log in to SmartConsole with full administrative privileges, giving the attacker the ability to view and modify security policy, alter Gateway configurations, push malicious rule changes, and pivot toward managed Security Gateways across the enterprise. Exploitation is gated by a specific but common misconfiguration: the Management Server (or MDS) must be reachable from the internet and the 'Trusted Clients' (GUI clients) setting must not be restricted to a defined allow-list of IP addresses/subnets (i.e., left at 'Any'). Check Point discovered the vulnerability during a routine internal 'BLAST' security-review program and confirmed, at disclosure, that a small number of customers had already been targeted in the wild. Two related but unexploited vulnerabilities were disclosed and patched in the same Jumbo Hotfix cycle: CVE-2026-62144, a Security Management authentication-bypass-plus-command-execution flaw (CVSS 9.3) letting an unauthenticated attacker run arbitrary commands on the Management server and pushed Security Gateways, and CVE-2026-62145, a Gaia Portal local privilege escalation (CVSS 7.5) letting a read-only authenticated admin run commands as root. Check Point released a Jumbo Hotfix Accumulator on 2026-07-22 (R82.10 Take 36+, R82 Take 118+, R81.20 Take 158+) closing all three issues, and CISA added CVE-2026-16232 to the Known Exploited Vulnerabilities catalog the same day under Binding Operational Directive 26-04, with a remediation due date of 2026-07-25. Six attacker-associated IP addresses were published as indicators of the observed exploitation activity, and defenders were pointed to a specific audit-log signature ('Authentication method: application token') for hunting.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1098 Account Manipulation
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1686 Disable or Modify System Firewall
- T1212 Exploitation for Credential Access
- T1528 Steal Application Access Token
- T1046 Network Service Discovery
- T1005 Data from Local System
- T1210 Exploitation of Remote Services
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1590 Gather Victim Network Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1550 Use Alternate Authentication Material
- T1685 Disable or Modify Tools
- T1518 Software Discovery
- T1021 Remote Services
- T1489 Service Stop
- T1136 Create Account
- T1070 Indicator Removal
- T1018 Remote System Discovery
- T1082 System Information Discovery
- T1556 Modify Authentication Process
- T1602 Data from Configuration Repository
- T1606 Forge Web Credentials
- T1016 System Network Configuration Discovery
- T1087 Account Discovery
- T1213 Data from Information Repositories

## Sources

- [Cyber Security News - Check Point Vulnerability Exploited](https://cybersecuritynews.com/check-point-vulnerability-exploited/)
- [Check Point sk185169 - CVE-2026-16232 Authentication bypass with SmartConsole login process using application token](https://support.checkpoint.com/results/sk/sk185169/)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-16232](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232)
- [NVD - CVE-2026-16232](https://nvd.nist.gov/vuln/detail/CVE-2026-16232)
- [Check Point Blog - Security Advisory: Action Required, Active Exploitation of SmartConsole Authentication Bypass (CVE-2026-16232)](https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232)
- [Check Point sk185152 - CVE-2026-62144 Management Authentication Bypass and Privilege Escalation](https://support.checkpoint.com/results/sk/sk185152/)
- [Check Point sk185153 - CVE-2026-62145 Local Privilege Escalation in Gaia Portal](https://support.checkpoint.com/results/sk/sk185153/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1650