{"id":"check-point-smartconsole-auth-bypass-jul-2026","category":"patch","status":"closed","title":"Check Point SmartConsole login bypass CVE-2026-16232 exploited; hotfix version guidance conflicts","tldr":"Attackers exploited Check Point SmartConsole login to gain administrator access to exposed business security-management servers. Hotfixes exist, but published version boundaries conflict. Ask IT to install the current vendor update and investigate access.","summary":"CVE-2026-16232 lets an attacker obtain a login token and gain full administrator access through Check Point SmartConsole without valid credentials, allowing changes to security policies and configurations. Check Point confirmed attacks against a small number of customers whose management servers were internet-accessible without Trusted Clients restrictions. It released Jumbo Hotfix updates on 22 July and said Smart-1 Cloud customers were already protected. Exact patch boundaries remain disputed: Rapid7 identifies R81.20 Take 158, R82 Take 118 and R82.10 Take 36 as fixed, while Check Point's later CVE entry explicitly includes those Takes among affected versions. Older releases are also affected, with no fixes specified in the reviewed guidance. Patch coverage is therefore recorded as partial, with exact fixed versions left unconfirmed. As at 3 November, the reviewed sources provide no later resolution of that discrepancy or confirmation that the attacks have ended.","action":"Nothing to update on ordinary family phones or computers. If your business or family office uses Check Point, ask its IT provider to install the current Jumbo Hotfix, confirm the safe Take with Check Point Support, restrict Trusted Clients and management access to trusted IP addresses, and investigate administrator and application-token activity.","product":"Check Point Security Management Server and Multi-Domain Security Management Server (SmartConsole login)","audience":"work","severity":"critical","patch":"partial","exploited":true,"cves":["CVE-2026-16232"],"tags":["check-point","smartconsole","authentication-bypass","zero-day","actively-exploited"],"affected":["Quantum Security Management and Multi-Domain Security Management: R82.10 with Jumbo Hotfix Take 36 or below, according to Check Point's CVE entry","Quantum Security Management and Multi-Domain Security Management: R82 with Jumbo Hotfix Take 118 or below, according to Check Point's CVE entry","Quantum Security Management and Multi-Domain Security Management: R81.20 with Jumbo Hotfix Take 158 or below, according to Check Point's CVE entry","Quantum Security Management and Multi-Domain Security Management: R81.10, R81, R80.30, R80.20, R80.10, R80 and R77.30"],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Security Advisory – Action Required – July 2026 Security Update","url":"https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232/","by":"Check Point","date":"2026-07-22"},{"kind":"advisory","title":"CVE-2026-16232: vendor CVE record and CISA exploitation metadata","url":"https://cveawg.mitre.org/api/cve/CVE-2026-16232","by":"Check Point and CISA","date":"2026-08-10"},{"kind":"advisory","title":"Check Point SmartConsole Authentication Bypass — CPAI-2026-9895","url":"https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-9895.html","by":"Check Point","date":"2026-08-02"},{"kind":"research","title":"CVE-2026-16232: Critical Check Point SmartConsole Authentication Bypass Exploited in the Wild","url":"https://www.rapid7.com/blog/post/etr-cve-2026-16232-critical-check-point-smartconsole-authentication-bypass-exploited-in-the-wild/","by":"Rapid7","date":"2026-07-23"},{"kind":"news","title":"Check Point warns of SmartConsole zero-day exploited in attacks","url":"https://www.bleepingcomputer.com/news/security/check-point-patches-smartconsole-zero-day-exploited-in-attacks/","by":"BleepingComputer","date":"2026-07-23"}],"started":"2026-07-22","closed":"2026-08-02","created":"2026-11-03T22:17:55.185Z","updated":"2026-11-03T22:17:55.185Z","cve_notes":[{"cve":"CVE-2026-16232","name":"Authentication bypass in Check Point SmartConsole login","what":"The SmartConsole login process can give an unauthenticated remote attacker an application token granting full administrator access to a management server, allowing security policies and configurations to be changed.","severity":"critical","cvss":9.3}],"timeline":[{"at":"2026-08-02","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Check Point updated its CVE entry to list R82.10 Take 36, R82 Take 118 and R81.20 Take 158, and earlier Takes, as affected. This conflicts with Rapid7's report identifying those same Takes as the first fixes; the exact minimum safe Takes remain unresolved in the sources reviewed.","url":"https://cveawg.mitre.org/api/cve/CVE-2026-16232","by":"Check Point","patch":null},{"at":"2026-07-29","added":"2026-11-03T22:11:23.504Z","kind":"other","text":"Check Point published an intrusion-prevention advisory for detecting attempts to exploit the flaw. This additional protection requires an IPS update and policy installation.","url":"https://advisories.checkpoint.com/defense/advisories/public/2026/cpai-2026-9895.html","by":"Check Point","patch":null},{"at":"2026-07-22","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-16232 to its Known Exploited Vulnerabilities catalogue, as recorded in its contribution to the CVE record.","url":"https://cveawg.mitre.org/api/cve/CVE-2026-16232","by":"Check Point and CISA","patch":null},{"at":"2026-07-22","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Check Point disclosed CVE-2026-16232 and released Jumbo Hotfix updates. It confirmed attacks against a handful of customers with internet-exposed management servers and no IP restrictions, and said it had notified those customers.","url":"https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232/","by":"Check Point","patch":"partial"}],"url":"https://hard.fyi/live/check-point-smartconsole-auth-bypass-jul-2026/","json":"https://hard.fyi/api/live?id=check-point-smartconsole-auth-bypass-jul-2026"}