Full research report

Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-16232 is particularly severe because it targets the security management layer itself, allowing an attacker with administrative control to modify firewall rules, access controls, and security configurations across the managed estate without authenticated credentials. The broken SIC distinguished-name trust boundary is a logic flaw in the application authentication handshake rather than a conventional memory-safety bug, making it difficult for generic scanning to identify. Rapid7's public PoC substantially lowers the bar for exploitation against organisations that have not applied the 22 July Jumbo Hotfixes, particularly where the default Trusted Clients configuration leaves management ports broadly accessible. No threat actor has been publicly attributed, but exploitation before disclosure indicates targeted activity against network-security infrastructure.

What happened

Check Point disclosed CVE-2026-16232, a critical authentication bypass (CVSS 9.3) in the SmartConsole login process, on 22 July 2026 alongside Jumbo Hotfixes and confirmation of active zero-day exploitation affecting a small number of customers. On 29 July 2026, Rapid7 researcher Stephen Fewer published a detailed technical analysis and a functional Python proof-of-concept that validates whether a target is vulnerable or patched.

Affected scope

CVE-2026-16232 affects Check Point Security Management Server and Multi-Domain Security Management Server (MDS) across versions R77.30 through R82.10 in on-premises deployments; Smart-1 Cloud was already protected at disclosure. Hotfixes are confirmed for R82.10, R82, and R81.20; availability for R81.10 and older versions is not confirmed.

Technical assessment

CVE-2026-16232 exploits a broken trust boundary in SmartConsole's application authentication path. The vulnerable server accepts an attacker-supplied Secure Internal Communication (SIC) distinguished name without binding it to the authenticated remote peer certificate DN. An attacker can read the server's own SIC DN during unauthenticated bootstrap communication, replay it to forge an application session, obtain an administrative login token, and mint a SmartConsole SSO ticket granting full administrator privileges over security policy and configuration. The patch enforces certificate DN matching at all authentication stages and rejects logins where no authenticated SIC identity is present. Exploitation requires only network access to the Management Server and the absence of Trusted Client IP restrictions, which testing indicates is the default configuration.

Recommended defensive actions

  1. Apply Check Point Jumbo Hotfix immediately: R82.10 Take 36 or later, R82 Take 118 or later, R81.20 Take 158 or later
  2. Restrict Trusted Clients in SmartConsole to specific administrator IP addresses rather than the default 'Any' setting to reduce exposure on unpatched systems
  3. Monitor SmartConsole audit logs for entries recording 'Authentication method: application token' originating from unrecognised source IPs
  4. Block and hunt for known attacker IPs published in the Check Point advisory: 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, 139.28.37.250, 194.213.18.137

Uncertainties and evidence gaps

  • No specific threat actor or campaign has been publicly attributed to CVE-2026-16232 exploitation
  • The total number of confirmed victims beyond Check Point's statement of 'a small number of customers' is not publicly disclosed
  • Hotfix availability for R81.10 and below is unconfirmed; organisations on older versions may require version upgrades rather than hotfix application
  • Post-compromise actions observed in confirmed CVE-2026-16232 incidents, beyond security policy modification, have not been publicly documented

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated network access to the Management Server on SIC/CPMI port 18190 and CPM SOAP port 19009; no Trusted Client IP restriction required to be absent for exploitation
ComponentSmartConsole application authentication path within Check Point Security Management Server
MechanismThe server binds application identity to an attacker-supplied SIC distinguished name rather than the authenticated remote peer certificate DN, permitting forged application identity to be accepted during the login handshake
ImpactFull administrative control over the security management server, enabling modification of firewall policies and security configuration across managed estate
DetectionAudit log entries recording 'Authentication method: application token' from unexpected source IPs; presence of vendor-published attacker IPs in connection logs
MitigationApply Jumbo Hotfix (R82.10 Take 36+, R82 Take 118+, R81.20 Take 158+); restrict Trusted Clients to known administrator IP ranges as an interim measure
Exploitation status

CVE-2026-16232 was confirmed under active exploitation as a zero-day before vendor disclosure on 22 July 2026; Rapid7 released a public functional PoC on 29 July 2026.

Research process

The investigation began with CVE-2026-16232 and the newly released Rapid7 PoC. Searches located the Check Point vendor advisory, Rapid7 emergency threat response and technical analysis, and the GitHub PoC repository; each was fetched and verified. Independent reporting corroborated active exploitation and the affected scope. The evidence supports a high-confidence assessment of the Check Point vulnerability and its immediate defensive priority.

  1. What are the confirmed details of CVE-2026-16232?
    Searched for CVE-2026-16232 Check Point SmartConsole authentication bypass 2026

    Multiple sources confirmed a critical authentication bypass actively exploited as a zero-day; vendor advisory sk185169, Rapid7 ETR, and a GitHub PoC identified as primary sources

    why Established event scope and located all primary sources for follow-up verification

  2. What does the primary vendor advisory say about affected versions and mitigation?
    Fetched Check Point support advisory sk185169
    support.checkpoint.com ↗

    Confirmed affected versions R77.30–R82.10, patch takes per version, Trusted Clients mitigation, and a list of six known attacker IPs

    why Vendor advisory is the authoritative source for patch specifics, exposure conditions, and detection indicators

  3. What does Rapid7's emergency threat response add on exploitation and patch status?
    Fetched Rapid7 ETR blog post on CVE-2026-16232
    rapid7.com ↗

    Confirmed CISA KEV listing with 25 July 2026 remediation deadline, CVSS 9.1–9.3, and that Smart-1 Cloud was already protected

    why Provided independent corroboration of exploitation status and supplied the CISA deadline context absent from the vendor advisory

  4. What is the technical root cause and is the Rapid7 PoC functional?
    Fetched Rapid7 technical analysis blog post and GitHub PoC repository
    github.com ↗

    SIC DN trust boundary flaw confirmed; GitHub PoC is a functional Python 3 script tested against R81.20 and R82.10 that succeeds on vulnerable targets and fails on patched ones

    why Confirmed the PoC is operational and the patch is effective, directly elevating exploitation risk for organisations that have not yet applied the hotfix

  5. Does an independent source corroborate exploitation and add any actor or scope detail?
    Fetched Security Affairs and Field Effect articles on CVE-2026-16232
    securityaffairs.com ↗

    Security Affairs confirmed exploitation and surfaced two additional related Check Point CVEs (CVE-2026-62144, CVE-2026-62145); no specific threat actor was named by any independent source

    why Two independent domains corroborate active exploitation; the absence of actor attribution is a material uncertainty for defenders

Named in this story
TargetsCheck Point Security Management Server operators
Related CVEs CVE-2026-16232

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 4 registered sources supplied useful evidence (2 primary, 1 corroborating, 1 contextual and 0 PoC/exploit references). 57 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
CISA KEVkev ok1656 records Primary evidence1 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
The Hacker Newsnews ok14 records Primary evidence1 matched items Published the source report used to frame and date the event.
Rapid7news ok2 records Corroborating2 matched items Supplied independent analysis opened and verified during focused research.
FIRST EPSSepss ok Context1 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
BleepingComputernews ok9 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Cisco PSIRTvendor_advisory ok5309 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok260 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok667 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok14 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1588 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok8 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 5 opened outside the registered collection
References & evidence
Vulnerability & exploitation2
CVE-2026-16232 CISA KEV Check Point SmartConsole · added 2026-07-22 CISA catalog ↗
CVE-2026-16232 EPSS 12.7% 96th percentile exploitation probability
Reporting-linked PoC claims1
https://github.com/sfewer-r7/CVE-2026-16232 github.com ↗

Linked by reporting but not validated as PoC by the configured exploit indexes.

PoC & exploit code1
sfewer-r7/CVE-2026-16232 – Rapid7 Python 3 PoC github.com ↗

Functional Python 3 script by Stephen Fewer (Rapid7) that successfully validates vulnerability or patch status; demonstrates full exploit chain against R81.20 and R82.10

Vendor & gov advisories1
sk185169 – CVE-2026-16232: Authentication Bypass with SmartConsole Login Process support.checkpoint.com ↗

Primary Check Point vendor advisory listing affected versions R77.30–R82.10, Jumbo Hotfix take numbers, known attacker IPs, and log-based detection guidance

Analysis & research3
Rapid7 ETR: CVE-2026-16232 Critical Check Point SmartConsole Authentication Bypass Exploited in the Wild rapid7.com ↗

Rapid7 emergency threat response confirming CVSS 9.1–9.3, CISA KEV listing with 25 July 2026 remediation deadline, and Smart-1 Cloud protection status

Rapid7 Technical Analysis: Check Point SmartConsole Authentication Bypass (CVE-2026-16232) rapid7.com ↗

Detailed root-cause analysis by Stephen Fewer explaining the SIC DN trust boundary flaw, patch mechanism, and PoC implementation

Security Affairs: Check Point Patches Actively Exploited SmartConsole Authentication Bypass Flaw securityaffairs.com ↗

Independent corroboration of exploitation status; surfaces related CVEs CVE-2026-62144 and CVE-2026-62145 and expands attacker IP list