Check Point · SmartConsole
Check Point SmartConsole, the administrative management client for Check Point security products, contains an improper authentication flaw in its login process. An unauthenticated remote attacker with internet access to the Management Server IP address can obtain an application login token and use it to authenticate with full administrative privileges, allowing them to modify security policies and configurations, provided the server's configuration does not restrict Trusted Clients.
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
First seen exploited 3 days before it was disclosed. Public exploit code (PoC-in-GitHub) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Stolen token grants valid administrative account access
use it to authenticate with full administrative privileges
Remote unauthenticated exploitation of exposed management server
allows an unauthenticated remote attacker to obtain an application login token
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2026-16232 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
On July 28th, 2026, Rapid7 Labs published technical details and Proof-of-Concept (PoC) exploit code for CVE-2026-16232 (CVSS: 9.1), a critical authentication bypass vulnerability in the……
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.