Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-16232: Check Point SmartConsole lets attackers gain admin access

CVE-2026-16232 · published 3 months ago · actively exploited

Summary

The SmartConsole management console and related Check Point security management tools can be tricked into issuing a login token without any user credentials. With that token, an attacker can log in as a full administrator and change settings or view data. Apply the latest security updates from Check Point and review account activity to protect your environment.

What to do

Update checkpoint multi-domain_security_management to version r81.20 or later.
Update checkpoint quantum_security_management to version r81.20 or later.

Affected software

Vendor	Product	Affected versions
check point	smartconsole	All versions
checkpoint	quantum security management	R82.10 with Jumbo Hotfix Take 36 or below
checkpoint	multi-domain security management	R82.10 with Jumbo Hotfix Take 36 or below
checkpoint	multi-domain_security_management	>= r77.30, < r81.20 r81.20 r82 r82.10 `cpe:2.3:a:checkpoint:multi-domain_security_management::::::::`
checkpoint	quantum_security_management	>= r77.30, < r81.20 r81.20 r82 r82.10 `cpe:2.3:a:checkpoint:quantum_security_management::::::::`

Original advisory text

Check Point SmartConsole Improper Authentication Vulnerability

Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.

References

https://vincent.vulcoord.net/score/?state=KEV&state=Reassess&excludecna=linux&cv...
https://support.checkpoint.com/results/sk/sk185169 Mitigation Patch Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-... US Government Resource

Fix within

Internet-facing 3 days

and check for signs of compromise

Internal 3 days

and check for signs of compromise

Known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.3 Critical

Exploitation

Known exploited

Listed in the CISA KEV catalogue - exploitation confirmed in the wild.

4% chance of attack within 30 days

Type

CWE-287Improper Authentication

Timeline

Published22 Jul 2026

Updated26 Oct 2026

First seen22 Jul 2026

Sources

CVE-2026-16232 · NVD

CVE-2026-16232 · MITRE

CVE-2026-16232 · CISA KEV

Track software like this

Free during beta