Check Point SmartConsole Authentication Bypass CVE-2026-16232 Exploited as Zero-Day, PoC and Details Public
Do Son 
TL;DR
Attackers are exploiting a SmartConsole authentication bypass in Check Point management servers. The flaw, CVE-2026-16232, lets an unauthenticated attacker gain full administrator access. Check Point confirmed active zero-day exploitation, and Rapid7 has now published the technical details and a public proof-of-concept.
- CVE: CVE-2026-16232
- CVSS: 9.1 (Critical · CVSSv3)
- Product: checkpoint Quantum Security Management
- Affected: R82.10 with Jumbo Hotfix Take 36 or below, R82 with Jumbo Hotfix Take 118 or below, R81.20 with Jumbo Hotfix Take 158 or below, R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30
- Impact: Authentication Bypass in the SmartConsole Login Process Using an Application Token
- Status: Exploited in the wild
- EPSS: 12.7% (30-day)
- Action: See vendor advisory
Why it matters
A management server controls every gateway in a Check Point estate. Therefore admin access there means near-total control. Security teams rely on these servers to push rules to firewalls. So a breach can expose the whole managed fleet.
This SmartConsole authentication bypass scores a critical CVSS of 9.1. Check Point says a small number of customers were already hit. CISA also added CVE-2026-16232 to its Known Exploited Vulnerabilities catalog. As a result, the patch window is tight.
How the attack works
The root cause is a broken trust boundary in the login path. A SmartConsole login crosses two management services. The legacy FWM service handles certificate-based trust. The newer CPM service handles SOAP login over HTTPS. The server should bind a client’s identity to its authenticated certificate. Instead, the flawed code trusts a distinguished name (DN) supplied by the caller.
An unauthenticated attacker reads the server’s own identity during setup. They then replay that identity in a forged bind request. The server accepts it, issues an application token, and mints a single sign-on ticket. That ticket grants a full admin session.
Exploitation status
Check Point reports active exploitation in the wild. A working proof-of-concept is also public. Rapid7 reproduced the SmartConsole authentication bypass against R81.20 and R82.10 builds. Read the full write-up in Rapid7’s technical analysis, and find the validation tool in Rapid7’s public PoC repository. For safety, this report omits the exploit steps and code.
Affected versions
The flaw affects Security Management Server and Multi-Domain Security Management. Its impact spans a wide release range, from older branches up to R82.10. Exploitation needs network access to the management IP. It also needs a Trusted Clients setting that does not restrict GUI clients. Rapid7 found that setting to be the default.
Patch and mitigation
Install the Jumbo Hotfix now, on an emergency basis. Check Point shipped fixes for R82.10 (Take 36 or later), R82 (Take 118 or later), and R81.20 (Take 158 or later). The patch binds identity to the authenticated peer certificate and rejects mismatched DN claims.
Meanwhile, restrict the Trusted Clients list to known GUI hosts. Remove direct internet exposure of the management server. Finally, hunt for the “Authentication method: application token” entry in your audit logs, since it can flag abuse.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
