Actively exploited in the wild
Check Point SmartConsole Improper Authentication Vulnerability
Check Point - SmartConsole · Listed in the CISA KEV since 2026-07-22. This indicates confirmed attacks in production environments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-16232
CriticalCVSS 9.1KEVExploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
Authentication bypass vulnerability in Check Point SmartConsole login. An unauthenticated remote attacker can obtain a login token and authenticate with full administrative privileges. The vulnerability is being actively exploited.
Risk Assessment
An attacker can modify security policies and configurations, potentially leading to full compromise of the managed infrastructure.
Recommendation
Apply security patches from Check Point. Restrict access to the Management Server to trusted clients and networks only.
Original NVD description (English source)
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.