Rapid7

Critical Zero-Day Vulnerability in Check Point SmartConsole Exploited

First seen 29 Jul 2026, 11:02 UTC • •72.9

Article Content

1 / 7

Browse articles

ThreatCluster •July 30, 2026 at 09:22 UTC

•CVE-2026-16232 allows unauthenticated access to Check Point SmartConsole.
•Exploitation requires network access and a default configuration setting.
•Patches have been released and confirmed to remediate the vulnerability.

On July 22, 2026, Check Point disclosed CVE-2026-16232, a critical authentication bypass vulnerability in SmartConsole affecting Security Management Server and Multi-Domain Security Management Server (MDS). This flaw allows unauthenticated attackers to gain full administrative access by exploiting the SmartConsole login process. The vulnerability is actively exploited in the wild as a zero-day, with a proof-of-concept (PoC) exploit available. Exploitation requires network access to the Management Server and a default Trusted Clients configuration. Check Point has confirmed that patches are available to remediate this vulnerability. Security professionals are urged to apply the patches immediately to mitigate risks. The vulnerability was reported to have been actively exploited before the patches were released.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 54d ago How this analysis works

Timeline

2026-07-22

CVE-2026-16232 published

Check Point disclosed a critical authentication bypass vulnerability affecting SmartConsole.

Rapid7

2026-07-22

CVE added to CISA KEV

CVE-2026-16232 was added to the CISA Known Exploited Vulnerabilities catalog due to active exploitation.

Rapid7

2026-07-22

First public PoC released

A proof-of-concept exploit script for CVE-2026-16232 was made publicly available, confirming the vulnerability's exploitation potential.

Cybersecuritynews

2026-07-29

Patches confirmed effective

Check Point confirmed that the patches for CVE-2026-16232 successfully remediate the vulnerability.

Rapid7

Threat Graph

9 entities, 14 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Zero-day Exploit
T1078 - Valid Accounts
T1190 - Exploit Public-Facing Application

Organization (1)

Check Point

Vulnerability (1)

CVE-2026-16232

Weakness (1)

CWE-287 - Improper Authentication

Affected Platform (3)

Check Point Security Management Server
Check Point SmartConsole
Multi-Domain Security Management Server

Relationships

CVE-2026-16232 targets Check Point Security Management Server
CVE-2026-16232 targets Check Point SmartConsole
CVE-2026-16232 targets Multi-Domain Security Management Server
Zero-day Exploit targets Check Point Security Management Server
Zero-day Exploit targets Check Point SmartConsole
Zero-day Exploit targets Multi-Domain Security Management Server
T1078 - Valid Accounts targets Check Point Security Management Server
T1078 - Valid Accounts targets Check Point SmartConsole
T1078 - Valid Accounts targets Multi-Domain Security Management Server
T1190 - Exploit Public-Facing Application targets Check Point Security Management Server
T1190 - Exploit Public-Facing Application targets Check Point SmartConsole
T1190 - Exploit Public-Facing Application targets Multi-Domain Security Management Server
CVE-2026-16232 related to Check Point
CVE-2026-16232 related to CWE-287 - Improper Authentication