CVE-2026-16232
KEV EPSS 70.0%KEV-listed same day as publication, vendor confirms in-the-wild attacks, emergency patches issued.
What: Authentication bypass in Check Point SmartConsole login allows unauthenticated remote attackers to obtain administrative tokens and modify security policies (KEV-listed, 2026-07-22).
Why it matters: CISA added CVE-2026-16232 to KEV catalog based on confirmed active exploitation. Check Point acknowledges in-the-wild attacks affecting a small number of customers. Attackers gain full admin control without credentials, enabling policy tampering on exposed Management Servers. Vendor issued emergency July 22 hotfix.
Where it's seen: CISA KEV advisory, vendor confirmation of exploitation, security news coverage, blue-team chatter about limiting management access and applying patches immediately.
RISK: CRITICAL — Unauthenticated remote admin takeover, confirmed exploitation, KEV-listed, firewall/policy tampering possible.
Description
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.