Full research report

Check Point SmartConsole Authentication Bypass Technical Analysis (CVE-2026-16232)

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

CVE-2026-16232 is a critical authentication bypass in Check Point's SmartConsole management interface that was actively exploited as a zero-day before vendor disclosure on 22 July 2026, with CISA adding it to the Known Exploited Vulnerabilities catalogue the same day. The root cause is a broken trust boundary in the FWM/CPMI application authentication path: the management server accepts an attacker-supplied SIC Distinguished Name as the application's identity without validating it against the authenticated TLS peer certificate, enabling an unauthenticated attacker to impersonate the server itself and obtain a full administrator session. Rapid7 Labs reproduced the vulnerability, published a detailed root-cause analysis, and released a public PoC, materially lowering the skill threshold for exploitation of any unpatched internet-exposed management server. Check Point confirmed exploitation against a small number of customers and published six attacker-associated IP addresses as indicators of compromise, though no threat actor has been attributed. The absence of patches for end-of-support versions (R77.30–R81.10) leaves a residual risk for organisations running legacy infrastructure that cannot be rapidly upgraded.

What happened

On 22 July 2026, Check Point published a security advisory and Jumbo Hotfix for CVE-2026-16232, a critical (CVSS 9.3) authentication bypass in the SmartConsole management console login process affecting Security Management Server and Multi-Domain Security Management Server. The vendor disclosed that the vulnerability had already been exploited as a zero-day against a small number of customers before the patch was issued. CISA added it to the Known Exploited Vulnerabilities catalogue on the same day, issuing a three-day remediation deadline for US federal agencies. Rapid7 Labs published a full root-cause analysis and validated proof-of-concept on 28 July 2026.

Affected scope

Check Point Security Management Server and Multi-Domain Security Management Server across versions R77.30 through R82.10. Supported releases with available patches are R81.20, R82, and R82.10. Versions R77.30 through R81.10 are end-of-support and will receive no remediation. Smart-1 Cloud was reported as unaffected. Exploitation requires the management interface to be reachable by the attacker and the Trusted Clients configuration to be set to 'Any' rather than restricted to specific IP addresses, which Rapid7 confirmed is the default setting.

Technical assessment

The flaw is classified as improper authentication (CWE-287) and arises in the bridge between two management services: the legacy FWM/CPMI service on TCP 18190, which uses Check Point's Secure Internal Communication (SIC) certificate-based trust, and the newer CPM/DLE SOAP service on TCP 19009. During the unauthenticated SIC bootstrap phase, the management server discloses its own SIC Distinguished Name (DN). The vulnerable code path in the Java login service accepts the attacker-supplied SIC DN as the claimed application identity without validating it against the authenticated TLS peer certificate DN. An unauthenticated attacker can replay the server's own DN in a forged application bind, obtain a valid application token from FWM, and then use that token to request a SmartConsole single sign-on ticket, resulting in a fully authenticated administrator session. This grants the ability to read and modify security policies, VPN configuration, and logging settings.

Recommended defensive actions

  1. Apply the vendor Jumbo Hotfix immediately: R82.10 requires Take 36 or later, R82 requires Take 118 or later, R81.20 requires Take 158 or later; organisations on end-of-support versions (R77.30–R81.10) should upgrade to a supported release as no patch is available.
  2. Restrict the Trusted Clients (GUI clients) configuration to specific authorised IP addresses or subnets; remove any 'Any' setting to prevent unauthenticated network-level access from untrusted hosts.
  3. Block internet-facing access to management interfaces at the network boundary; firewall TCP 18190 (FWM/CPMI) and TCP 19009 (CPM/DLE) to authorised management workstations only.
  4. Hunt SmartConsole audit logs for entries showing 'Authentication method: application token' from unexpected sources or at unexpected times, which is the primary detection signal for exploitation of this vulnerability.
  5. Block the six attacker-associated IP addresses published by Check Point: 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, 139.28.37.250, 194.213.18.137.
  6. Audit security policy and VPN configuration for unauthorised modifications since the beginning of July 2026 and investigate any administrator sessions using application token authentication.

Uncertainties and evidence gaps

  • No threat actor has been attributed to the observed exploitation; the campaign's origin, intent, and full breadth remain unknown.
  • Check Point disclosed only that 'a handful of customers' were affected; the true number of compromised management servers is not publicly confirmed.
  • Organisations running end-of-support versions (R77.30 through R81.10) have no vendor patch path; their exposure and remediation options are unquantified.
  • Whether the public Rapid7 PoC has enabled wider opportunistic exploitation beyond the initial zero-day campaign has not been confirmed at the time of this report.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessUnauthenticated remote network access to the Check Point Management Server, either internet-exposed or reachable from an untrusted network segment without Trusted Client IP restrictions
ComponentSmartConsole FWM/CPMI application authentication boundary on TCP 18190 (SIC bootstrap and FwSet protocol service)
MechanismThe server accepts an attacker-supplied SIC Distinguished Name as the application identity claim without validating it against the authenticated TLS peer certificate DN, enabling identity impersonation during the unauthenticated bootstrap phase
ImpactUnauthenticated attacker obtains a fully authenticated SmartConsole administrator session, enabling read and write access to security policy, VPN configuration, and logging settings
DetectionSmartConsole audit log entries recording 'Authentication method: application token' from unrecognised sources; inbound connections to TCP 18190 or TCP 19009 from the six published attacker IP addresses
MitigationApply Jumbo Hotfix (R82.10 Take 36+, R82 Take 118+, R81.20 Take 158+); restrict Trusted Clients to authorised IP addresses; firewall management ports from untrusted networks
Exploitation status

Confirmed active exploitation in the wild as a zero-day at time of disclosure on 22 July 2026; CISA added CVE-2026-16232 to the Known Exploited Vulnerabilities catalogue the same day; Check Point confirmed a small number of customers were targeted.

Research process

Investigation began with the Rapid7 technical analysis and the Check Point vendor knowledge base article (sk185169) as primary sources, which together confirmed the zero-day exploitation status, root cause, affected version range, patch details, and attacker IoC IP addresses. Web searches identified multiple independent corroborating outlets including BleepingComputer, Help Net Security, and The Hacker News, all consistent with vendor and Rapid7 findings. The Rapid7 GitHub repository for the PoC exploit script was confirmed to be live and publicly accessible. OTX AlienVault pulse URLs cited in the source material failed to render due to client-side JavaScript requirements and were excluded from verified citations. The evidence base across four independent source domains supports a high-confidence assessment.

  1. What does Rapid7's full technical analysis say about the vulnerability mechanism, affected versions, and PoC availability?
    Fetched the Rapid7 technical deep-dive blog post
    rapid7.com ↗

    Confirmed root cause as broken SIC DN trust boundary; PoC validates against R81.20 and R82.10; patch confirmed to block PoC; GitHub repository named as sfewer-r7/CVE-2026-16232

    why Established the primary technical narrative and PoC reference; Rapid7 is the original researcher and carries high evidentiary weight

  2. What does the official vendor advisory say about affected versions, patches, mitigations, and exploitation evidence?
    Fetched the Check Point support knowledge base article sk185169
    support.checkpoint.com ↗

    Confirmed affected versions R77.30–R82.10; patch builds specified; end-of-support versions receive no fix; six attacker IP addresses published as IoCs; exploitation confirmed as affecting a limited customer base

    why Primary vendor source; provides authoritative patch numbers and the only published attacker infrastructure indicators

  3. Do independent news outlets corroborate the zero-day exploitation status and CISA KEV addition?
    Searched for CVE-2026-16232 across security news sources and fetched BleepingComputer's coverage
    bleepingcomputer.com ↗

    Confirmed zero-day status at disclosure, CISA KEV addition on 22 July 2026, federal deadline of 25 July 2026, and IoC IP addresses consistent with vendor advisory

    why Independent corroboration from a high-credibility security news domain; consistent findings increase confidence in exploitation claims

  4. Are co-disclosed vulnerabilities in the same advisory relevant to this story's scope?
    Fetched Help Net Security's coverage of the July 2026 Check Point advisory
    helpnetsecurity.com ↗

    Confirmed CVE-2026-62144 (CVSS 9.3, unauthenticated remote command execution) and CVE-2026-62145 (CVSS 7.5, Gaia Portal privilege escalation) are co-disclosed in the same hotfixes but are distinct from CVE-2026-16232

    why Clarifies advisory scope; co-disclosed CVEs are related to the same patch cycle and relevant for defenders applying the hotfix

  5. Is the Rapid7 PoC GitHub repository publicly accessible?
    Sent an HTTP HEAD request to the GitHub repository URL

    HTTP 200 response confirmed the repository is live and publicly accessible

    why Verifies that a public PoC is available to any attacker, raising the urgency of patching for unpatched internet-exposed management servers

  6. Does The Hacker News provide additional corroboration or detail not found in other sources?
    Fetched The Hacker News article on CVE-2026-16232
    thehackernews.com ↗

    Consistent with other sources; confirmed CISA KEV, exploitation scope, IoC addresses, and no threat actor attribution; adds a third independent news domain

    why Provides a third independent corroborating domain, strengthening overall confidence without contradicting established findings

Named in this story
TargetsCheck Point Security Management Server operatorsnetwork security administrators managing Check Point firewall estatesinternet-exposed Check Point management infrastructure
Related CVEs CVE-2026-16232CVE-2026-62144CVE-2026-62145

Research coverage

All 68 registered source leaves were evaluated for this run: 60 completed, 0 were unavailable, 1 failed and 7 were disabled. For this story, 5 registered sources supplied useful evidence (2 primary, 1 corroborating, 2 contextual and 0 PoC/exploit references). 55 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
CISA KEVkev ok1655 records Primary evidence1 matched items Confirmed that a related CVE is listed in CISA's Known Exploited Vulnerabilities catalogue.
Rapid7news ok5 records Primary evidence3 matched items Published the source report used to frame and date the event. Supplied a vendor or government advisory opened and verified during focused research. Supplied a PoC or technical exploit reference opened and verified during focused research.
BleepingComputernews ok7 records Corroborating1 matched items Supplied independent analysis opened and verified during focused research.
AlienVault OTXdark_web ok10 records Context2 matched items Provided lower-confidence OSINT context matched to an explicit CVE.
FIRST EPSSepss ok7121 records Context1 matched items Added exploitation-probability context; EPSS does not itself prove exploitation.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Cisco PSIRTvendor_advisory stale fallback0 records Failed The current collection attempt failed; this source cannot support the report.
Cisco Talosnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok260 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok666 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1005 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok8 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok9 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok15 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok19 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft MSRCvendor_advisory ok1588 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Sophos IOCsresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
The Hacker Newsnews ok11 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 4 opened outside the registered collection
References & evidence
Vulnerability & exploitation2
CVE-2026-16232 CISA KEV Check Point SmartConsole · added 2026-07-22 CISA catalog ↗
CVE-2026-16232 EPSS 12.7% 96th percentile exploitation probability
Reporting-linked PoC claims1
https://github.com/sfewer-r7/CVE-2026-16232 github.com ↗

Linked by reporting but not validated as PoC by the configured exploit indexes.

OSINT / dark-web chatter2
Check Point SmartConsole Authentication Bypass (CVE-2026-16232) otx.alienvault.com ↗ · 7 IOCs
Security Advisory - Action Required - July 2026 Security Update otx.alienvault.com ↗ · 8 IOCs
PoC & exploit code1
Check Point SmartConsole Authentication Bypass Technical Analysis (CVE-2026-16232) – Rapid7 rapid7.com ↗

Full root-cause and exploitation-flow analysis with annotated source code from Rapid7 Labs

Vendor & gov advisories2
sk185169 – CVE-2026-16232: Authentication bypass with SmartConsole login process using application token support.checkpoint.com ↗

Primary vendor advisory listing affected versions, Jumbo Hotfix numbers, mitigations, and attacker IoC IP addresses

CVE-2026-16232: Critical Check Point SmartConsole Authentication Bypass Exploited in the Wild – Rapid7 ETR rapid7.com ↗

Emergent threat response post confirming exploitation, attacker IPs, and CISA KEV addition

Analysis & research3
Check Point warns of SmartConsole zero-day exploited in attacks – BleepingComputer bleepingcomputer.com ↗

Independent corroboration of zero-day status, federal remediation deadline, and Check Point IoC disclosure

Attackers exploit critical Check Point flaw to take over firewall management – Help Net Security helpnetsecurity.com ↗

Details co-disclosed CVEs CVE-2026-62144 and CVE-2026-62145 alongside CVE-2026-16232 in the same hotfixes

Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access – The Hacker News thehackernews.com ↗

Confirms exploitation scope and CISA KEV listing; independent corroboration from a third news domain