Check Point SmartConsole improper authentication
CVE-2026-16232 lets unauthenticated attackers grab an admin token from SmartConsole. CISA KEV addition July 22; Check Point confirms active exploitation.
- Vendor
- Check Point
- Product
- SmartConsole
- CVSS
- 9.1
- EPSS (exploit probability)
- 3.5%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-16232 being exploited?
Yes. CISA added CVE-2026-16232 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild. It is also listed in CIRCL's KEV catalog.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 3.5% (scored October 25, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ LISTED ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-16232 timeline
- First 0dayNews coveragesame day as NVD
- Added to CISA KEVsame day as NVD
- Published to NVD
- Added to CIRCL KEV+7d
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
An authentication bypass in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and authenticate with full administrative privileges. NVD scores it 9.1 (Critical) under CVSS 3.1. The vulnerability was published to NVD on July 22, 2026.
CISA added CVE-2026-16232 to the Known Exploited Vulnerabilities catalog on July 22, 2026. Check Point confirmed active exploitation in its advisory, noting that “a very small number of customers” have been affected.
Exposure condition: Remote exploitation requires network access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Environments that restrict SmartConsole connections to specific trusted hosts are not exposed via the remote path.
Remediation: Apply the patched build described in Check Point security advisory sk185169. If patching is not immediately possible, enabling Trusted Client restrictions on the Management Server blocks the remote attack vector. See NVD record for CVE-2026-16232.
Full coverage: Check Point SmartConsole auth bypass — CISA KEV, active exploitation.
Other Check Point CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-93616 Check Point Multiple Products Path Traversal Vulnerabilitywrite-up | [ CRITICAL ] | 9.8 | 91.6% | |
| CVE-2026-85102 Unauthenticated RCE via VPN certificate handling in Check Point productswrite-up | [ CRITICAL ] | 9.8 | 54.1% | |
| CVE-2026-91843 Stack overflow in login handler allows unauthenticated RCE as rootwrite-up | [ CRITICAL ] | 9.8 | 0.5% | — |
| CVE-2026-85103 Unauthenticated RCE via VPN certificate handling in Check Point productswrite-up | [ CRITICAL ] | 9.8 | 4.3% | — |
| CVE-2026-50751 Check Point Security Gateway Improper Authentication Vulnerabilityransomware use | [ CRITICAL ] | 9.3 | 85.3% | |
| CVE-2024-24919 Check Point Quantum Security Gateways Information Disclosure Vulnerabilityransomware use | [ HIGH ] | 8.6 | 100.0% |
