Check Point SmartConsole login bypass CVE-2026-16232 exploited; hotfix version guidance conflicts
Attackers exploited Check Point SmartConsole login to gain administrator access to exposed business security-management servers. Hotfixes exist, but published version boundaries conflict. Ask IT to install the current vendor update and investigate access.
Nothing to update on ordinary family phones or computers. If your business or family office uses Check Point, ask its IT provider to install the current Jumbo Hotfix, confirm the safe Take with Check Point Support, restrict Trusted Clients and management access to trusted IP addresses, and investigate administrator and application-token activity.
What’s happening
CVE-2026-16232 lets an attacker obtain a login token and gain full administrator access through Check Point SmartConsole without valid credentials, allowing changes to security policies and configurations. Check Point confirmed attacks against a small number of customers whose management servers were internet-accessible without Trusted Clients restrictions. It released Jumbo Hotfix updates on 22 July and said Smart-1 Cloud customers were already protected. Exact patch boundaries remain disputed: Rapid7 identifies R81.20 Take 158, R82 Take 118 and R82.10 Take 36 as fixed, while Check Point's later CVE entry explicitly includes those Takes among affected versions. Older releases are also affected, with no fixes specified in the reviewed guidance. Patch coverage is therefore recorded as partial, with exact fixed versions left unconfirmed. As at 3 November, the reviewed sources provide no later resolution of that discrepancy or confirmation that the attacks have ended.
- What
- Flaw
- Affects
- Check Point Security Management Server and Multi-Domain Security Management Server (SmartConsole login)
- Affected
- Quantum Security Management and Multi-Domain Security Management: R82.10 with Jumbo Hotfix Take 36 or below, according to Check Point's CVE entry
Quantum Security Management and Multi-Domain Security Management: R82 with Jumbo Hotfix Take 118 or below, according to Check Point's CVE entry
Quantum Security Management and Multi-Domain Security Management: R81.20 with Jumbo Hotfix Take 158 or below, according to Check Point's CVE entry
Quantum Security Management and Multi-Domain Security Management: R81.10, R81, R80.30, R80.20, R80.10, R80 and R77.30 - Fixed in
- No fix yet
- Since
- 22 July 2026
- Closed
- 2 Aug 2026
Timeline
- Vendor revised
Check Point updated its CVE entry to list R82.10 Take 36, R82 Take 118 and R81.20 Take 158, and earlier Takes, as affected. This conflicts with Rapid7's report identifying those same Takes as the first fixes; the exact minimum safe Takes remain unresolved in the sources reviewed.
- Update
Check Point published an intrusion-prevention advisory for detecting attempts to exploit the flaw. This additional protection requires an IPS update and policy installation.
- CISA added
CISA added CVE-2026-16232 to its Known Exploited Vulnerabilities catalogue, as recorded in its contribution to the CVE record.
- Made publicPartly fixed
Check Point disclosed CVE-2026-16232 and released Jumbo Hotfix updates. It confirmed attacks against a handful of customers with internet-exposed management servers and no IP restrictions, and said it had notified those customers.
Sources
- Security Advisory – Action Required – July 2026 Security UpdateCheck Point · 22 July 2026
- CVE-2026-16232: vendor CVE record and CISA exploitation metadataCheck Point and CISA · 10 Aug 2026
- Check Point SmartConsole Authentication Bypass — CPAI-2026-9895Check Point · 2 Aug 2026
- CVE-2026-16232: Critical Check Point SmartConsole Authentication Bypass Exploited in the WildRapid7 · 23 July 2026
- Check Point warns of SmartConsole zero-day exploited in attacksBleepingComputer · 23 July 2026