Check Point SmartConsole Authentication Bypass Vulnerability Exploited

On July 22, 2026, Check Point disclosed CVE-2026-16232, a critical authentication bypass vulnerability in SmartConsole affecting Security Management Server and Multi-Domain Security Management Server (MDS). This flaw allows unauthenticated attackers to gain full administrator access by exploiting a broken trust boundary in the authentication process. The vulnerability was actively exploited in the wild as a zero-day before patches were available. Rapid7 Labs confirmed the vulnerability's exploitation and developed a proof-of-concept (PoC) exploit script. The affected versions include R81.20 and R82.10, and vendor patches have been released to remediate the issue. The vulnerability requires network access to the Management Server and a default Trusted Clients configuration that does not restrict GUI clients. Security professionals are advised to apply the patches immediately to mitigate risks.

Key Points: • CVE-2026-16232 allows unauthenticated access to SmartConsole with full admin privileges. • The vulnerability was actively exploited as a zero-day before patches were available. • Rapid7 Labs has released a PoC exploit script to validate vulnerable systems.