Full research report

Check Point warns of SmartConsole zero-day exploited in attacks

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-16232 is a management-plane authentication bypass of the highest practical severity: an unauthenticated attacker who can reach a Check Point Security Management Server over the internet can obtain a privileged session token without credentials and then freely rewrite the security policy enforced by all downstream gateway appliances, effectively dismantling an organisation's perimeter controls in a single step. Check Point's own statement limits confirmed victims to 'a handful of customers' in a specific misconfiguration, which is consistent with a targeted campaign using private tooling rather than broad opportunistic exploitation. However, CVE-2026-16232 is the third Check Point product vulnerability to reach CISA's Known Exploited Vulnerabilities catalogue since May 2024, reflecting sustained and diverse adversary interest — from China-nexus espionage actors (NailaoLocker/CVE-2024-24919 targeting European healthcare) to ransomware affiliates (Qilin/CVE-2026-50751) to the current unattributed CVE-2026-16232 campaign. The identity of the actors exploiting CVE-2026-16232 remains the primary intelligence gap; until attribution is established, defenders should treat any internet-exposed Check Point management interface as actively targeted and apply the Jumbo Hotfix, restrict Trusted Client IPs, and audit logs against the six published IoC addresses without delay.

What happened

On 22 July 2026, Check Point issued an emergency security advisory and released Jumbo Hotfixes for CVE-2026-16232, a critical authentication bypass (CVSS 9.3) in SmartConsole, the graphical management interface for Check Point security products. An unauthenticated attacker can obtain an application login token and authenticate to a Security Management Server or Multi-Domain Security Management Server with full administrator privileges, enabling modification of enforced security policies and gateway configurations. Check Point confirmed active exploitation against a small number of customers whose management interfaces were directly exposed to the internet without IP-based client restrictions. CISA added the flaw to its Known Exploited Vulnerabilities catalogue the same day, imposing a 25 July 2026 remediation deadline for US federal civilian agencies under Binding Operational Directive 26-04.

Affected scope

Check Point Security Management and Multi-Domain Management running versions R80 through R82.10 where the Management Server is reachable from the internet without Trusted Client IP restrictions; Smart-1 Cloud deployments are confirmed unaffected. CVE-2026-50751 separately affects Security Gateway appliances with Remote Access VPN or Mobile Access configured for IKEv1. CVE-2024-24919 affects Quantum Security Gateway appliances and has been KEV-listed since May 2024.

Technical assessment

CVE-2026-16232 is classified as CWE-287 (Improper Authentication). The SmartConsole login process can be induced to issue an application session token without validating user credentials; the management server then accepts this token as a fully privileged administrative session. An attacker holding this token can read, replace, or delete the security policy enforced by all downstream gateway appliances, effectively dismantling perimeter controls from the management plane. Exploitation is constrained to environments where the management port is network-accessible from untrusted hosts without IP-based client allow-listing. CVE-2026-50751 is a distinct authentication bypass arising from a logic flaw in IKEv1 processing on Security Gateway VPN blades. CVE-2024-24919 enabled password-hash retrieval from Quantum Gateways and served as the initial access vector for a China-nexus espionage campaign that also deployed ransomware.

Recommended defensive actions

  1. Apply the Check Point Jumbo Hotfix immediately: R82.10 Take 36 or later, R82 Take 118 or later, R81.20 Take 158 or later.
  2. If patching cannot be completed immediately, restrict Trusted Clients (SmartConsole GUI clients) to authorised IP addresses or subnets and enforce perimeter firewall rules blocking management-plane access from untrusted networks.
  3. Review SmartConsole Audit Logs under Logs & Monitor > Audit Logs View; query for 'Authentication method: application token' events filtered against the six published malicious IPs: 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, 139.28.37.250, 194.213.18.137.
  4. Disable IKEv1 on Security Gateway VPN blades to close the separate CVE-2026-50751 attack surface exploited by Qilin ransomware.

Uncertainties and evidence gaps

  • The identity and attribution of the threat actor(s) actively exploiting CVE-2026-16232 have not been publicly disclosed.
  • The true victim count and any post-compromise payload or activity beyond policy modification remain unknown; Check Point's description of 'a handful of customers' is not quantified.
  • Fix availability for versions R81.10, R81, R80.30 and earlier is unconfirmed; Rapid7's version matrix did not specify Jumbo Hotfix take numbers for those branches.
  • No verified public proof-of-concept has been identified, but the absence of published exploit code does not exclude private tooling in active use.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated remote attacker with network access to the Management Server IP on deployments without Trusted Client IP restrictions
ComponentCheck Point SmartConsole login process on Security Management Server (SMS) and Multi-Domain Security Management Server (MDS)
MechanismCWE-287 Improper Authentication: the login flow issues an application session token without verifying user credentials; the server accepts this token as a fully privileged administrative session
ImpactFull administrative control of the security management plane; attacker can read, modify, or delete enforced security policies and gateway configurations across all managed appliances
DetectionSmartConsole Audit Logs: search for 'Authentication method: application token' events and cross-reference source/destination against six published malicious IPs (151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, 139.28.37.250, 194.213.18.137)
MitigationApply July 22, 2026 Jumbo Hotfix (R82.10 ≥ Take 36, R82 ≥ Take 118, R81.20 ≥ Take 158); restrict Trusted Clients to authorised IP ranges; firewall management-plane ports from untrusted networks
Exploitation status

CVE-2026-16232 confirmed exploited in the wild against internet-exposed Check Point management servers; CISA KEV-listed 2026-07-22. CVE-2026-50751 exploited by Qilin ransomware affiliate from May 2026. CVE-2024-24919 exploited in 2024 by China-nexus actors delivering NailaoLocker. No public PoC confirmed for CVE-2026-16232.

Research process

The investigation began with a BleepingComputer report of an actively exploited SmartConsole zero-day confirmed by CISA's KEV listing. Fetching the article established the core facts: the CVE, exploitation conditions, IoC IP addresses, and links to prior Check Point vulnerabilities. The vendor's own advisory blog was fetched next and provided authoritative version-specific patch data, the complete six-IP IoC list, and two co-patched CVEs. Independent technical corroboration came from Rapid7's emergency threat response, which confirmed CWE classification, CVSS scores from two authorities, and version-specific Jumbo Hotfix take numbers. SecurityWeek provided a third independent domain placing the event in context as Check Point's third KEV entry since May 2024. Targeted searches on CVE-2026-50751 and CVE-2024-24919 confirmed the historical exploitation pattern; the primary Orange Cyberdefense source on NailaoLocker was inaccessible (HTTP 403) and was not cited. A dedicated search found no verified public PoC for CVE-2026-16232.

  1. What are the confirmed technical facts and exploitation details for CVE-2026-16232?
    Fetched the BleepingComputer article covering the story
    bleepingcomputer.com ↗

    Authentication bypass in SmartConsole yields admin-level application tokens with no credential requirement; exploitation requires internet-exposed management without IP restrictions; CISA BOD 26-04 deadline 25 July 2026; five IoC IPs listed; CVE-2026-50751 (Qilin) and CVE-2024-24919 (NailaoLocker) referenced as prior Check Point KEV entries.

    why Established the event baseline from the primary reporting source and identified authoritative vendor URLs to verify.

  2. Which official vendor advisory and patch exist for CVE-2026-16232?
    Searched for Check Point's official advisory for CVE-2026-16232

    Check Point blog advisory URL identified; Jumbo Hotfix dated July 22, 2026 confirmed; co-patched CVEs CVE-2026-62144 and CVE-2026-62145 noted.

    why Search results established the authoritative vendor URL before fetching, confirming the advisory existed and was publicly accessible.

  3. What do the vendor's own words say about affected scope, severity, and fix specifics?
    Fetched the Check Point security blog advisory
    blog.checkpoint.com ↗

    CVSS 9.3; affected versions R80 through R82.10; six IoC IPs including 194.213.18.137 not listed in BleepingComputer; CVE-2026-62144 and CVE-2026-62145 co-patched but confirmed unexploited; Smart-1 Cloud unaffected; exploitation described as limited to 'a handful of customers'.

    why Vendor advisory is the highest-authority source; added the sixth IoC IP and confirmed the exploitation scope qualifier and cloud exception.

  4. Is there independent technical analysis confirming CVSS, CWE, and version-specific patch takes?
    Fetched Rapid7's emergency threat response for CVE-2026-16232
    rapid7.com ↗

    CVSS 9.1 per CISA, 9.3 per vendor; CWE-287 confirmed; Jumbo Hotfix takes specified per version (R82.10 Take 36+, R82 Take 118+, R81.20 Take 158+); R81.10 and older branches have no fix take specified.

    why Independent verification from a major security vendor; added actionable remediation granularity and identified a gap in fix coverage for older branches.

  5. What is the background on CVE-2026-50751 and the Qilin ransomware connection?
    Searched for CVE-2026-50751 and Qilin ransomware exploitation

    CVE-2026-50751 is a logic flaw in IKEv1 processing on Security Gateway VPN blades (CVSS 9.3); exploited by a Qilin ransomware affiliate from at least 7 May 2026; CISA KEV added 8–9 June 2026; dozens of organisations targeted globally.

    why Confirmed the article's attribution of CVE-2026-50751 to Qilin and established the sustained adversary interest in Check Point appliances predating the current event.

  6. What is the historical context of CVE-2024-24919 and NailaoLocker ransomware?
    Searched for CVE-2024-24919 NailaoLocker and Orange Cyberdefense CERT

    CVE-2024-24919 (CVSS 7.5) allowed password-hash retrieval from Quantum Gateways; exploited from April 2024; Orange Cyberdefense CERT identified as 'Green Nailao' campaign attributed to China-nexus actors deploying ShadowPad, PlugX, and NailaoLocker ransomware against European healthcare.

    why Confirmed the article's NailaoLocker attribution and established the pattern of state-linked and ransomware actors both targeting Check Point product lines.

  7. Does any verified public PoC exist for CVE-2026-16232?
    Searched for public proof-of-concept or exploit code for CVE-2026-16232

    No specific public PoC found; search returned generic CVE aggregator repositories with no confirmed entry for this CVE.

    why Absence of a verified public PoC is a material data point suggesting exploitation relies on private tooling, though it does not reduce the urgency to patch given confirmed active exploitation.

  8. Does an independent news outlet corroborate the exploitation status and place it in broader context?
    Fetched SecurityWeek's coverage of the Check Point zero-day
    securityweek.com ↗

    Confirmed CVE-2026-16232 active exploitation and CISA KEV listing; co-patched CVE-2026-62144 and CVE-2026-62145 noted as unexploited; characterised this as Check Point's third KEV entry since May 2024; current attacker identity remains unattributed.

    why Third independent domain confirming the core facts and providing the 'third KEV entry' context that strengthens the pattern-of-targeting assessment.

Named in this story
ActorsUnknown threat actor (CVE-2026-16232 exploitation)Qilin ransomware affiliate (CVE-2026-50751)China-nexus threat actors – Green Nailao campaign (CVE-2024-24919)
MalwareNailaoLockerShadowPadPlugX
TargetsOrganisations with internet-exposed Check Point Security Management ServersEuropean healthcare organisationsUS federal civilian executive branch agencies
Related CVEs CVE-2026-16232CVE-2026-50751CVE-2024-24919

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 57 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok12 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
CISA KEVkev ok1653 records Primary evidence3 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
Rapid7news ok2 records Corroborating1 matched items Supplied independent analysis opened and verified during focused research.
FIRST EPSSepss ok Context2 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Cisco PSIRTvendor_advisory ok5307 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok260 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok662 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok11 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok9 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1583 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok10 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 4 opened outside the registered collection
References & evidence
Vulnerability & exploitation5
CVE-2026-16232 CISA KEV Check Point SmartConsole · added 2026-07-22 CISA catalog ↗
CVE-2026-50751 CISA KEV Check Point Security Gateway · added 2026-06-08 · used in ransomware CISA catalog ↗
CVE-2024-24919 CISA KEV Check Point Quantum Security Gateways · added 2024-05-30 · used in ransomware CISA catalog ↗
CVE-2024-24919 EPSS 100.0% 100th percentile exploitation probability
CVE-2026-50751 EPSS 70.1% 99th percentile exploitation probability
Vendor & gov advisories1
Check Point Security Advisory – Active Exploitation of SmartConsole Authentication Bypass (CVE-2026-16232) blog.checkpoint.com ↗

Primary vendor advisory: affected versions R80–R82.10, Jumbo Hotfix takes, six IoC IPs, co-patched CVE-2026-62144 and CVE-2026-62145.

Analysis & research3
Rapid7 ETR: CVE-2026-16232 Critical Check Point SmartConsole Authentication Bypass Exploited in the Wild rapid7.com ↗

Independent technical analysis: CWE-287, CVSS 9.1/9.3, version-specific Jumbo Hotfix take numbers, notes no fix specified for R81.10 and earlier.

SecurityWeek: New Check Point Zero-Day Vulnerability Exploited in the Wild securityweek.com ↗

Third independent domain; confirms active exploitation and contextualises CVE-2026-16232 as Check Point's third KEV entry since May 2024.

BleepingComputer: Check Point Patches SmartConsole Zero-Day Exploited in Attacks bleepingcomputer.com ↗

Primary reporting; includes IoC IP list, CISA BOD 26-04 deadline, and historical context for CVE-2026-50751 and CVE-2024-24919.