CISA Warns of Check Point Authentication Vulnerability Exploited in Attacks
Key Takeaways CISA has issued an urgent warning about active exploitation of CVE-2026-16232, a critical authentication bypass vulnerability in Check Point SmartConsole. The flaw, rated 9.3 CVSS,...
Key Takeaways
- CISA has issued an urgent warning about active exploitation of CVE-2026-16232, a critical authentication bypass vulnerability in Check Point SmartConsole.
- The flaw, rated 9.3 CVSS, allows unauthenticated remote attackers to gain full administrative access to Check Point Security Management and Multi-Domain Management platforms.
- Exploitation has been observed in limited attacks, primarily targeting environments where management interfaces are directly exposed to the internet.
- Affected versions include R81.10, R81.20, R82, and R82.10, with older versions also potentially vulnerable.
- Immediate action is required, including deploying the Jumbo Hotfix released on July 22, 2026, and restricting management interface access.
Check Point SmartConsole Flaw Actively Exploited for Administrative Access
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding an authentication vulnerability within Check Point SmartConsole. This flaw is actively being exploited in the wild, necessitating immediate defensive measures from organizations utilizing the affected platforms.
Table Of Content
Designated as CVE-2026-16232, this severe security bypass impacts Check Point Security Management and Multi-Domain Management platforms, carrying a high CVSS score of 9.3. The vulnerability is rooted in an improper authentication mechanism (CWE-287), which allows an unauthenticated attacker operating remotely to acquire an application login token. With this token, threat actors can bypass standard authentication protocols and achieve complete administrative control over the compromised systems.
Details of the Exploitation
Check Point identified the vulnerability during an internal BLAST (Business Logic Attack Surface Testing) review, part of its Frontier AI Readiness Program. During this analysis, researchers discovered that CVE-2026-16232 was not merely theoretical but had already been leveraged in real-world attacks, affecting a limited number of their customers.
Current intelligence suggests that the exploitation is confined to environments where Check Point management interfaces are directly accessible from the internet without the protection of IP-based access restrictions. This direct exposure significantly broadens the attack surface, enabling malicious actors to remotely target and compromise vulnerable management systems.
A successful exploitation could empower attackers to alter security policies, deploy unauthorized configurations, or establish a deeper foothold within enterprise networks. Given the administrative privileges afforded by this exploit, the potential ramifications could extend to a complete compromise of an organization’s infrastructure.
CISA’s inclusion of the vulnerability in its Known Exploited Vulnerabilities (KEV) catalog underscores the urgency for organizations to apply patches and implement mitigations. Users of affected versions, specifically R81.10, R81.20, R82, and R82.10, are strongly advised to act immediately. Older versions may also be susceptible, expanding the potential risk landscape.
In addition to CVE-2026-16232, Check Point disclosed two other high-severity vulnerabilities in the same advisory. CVE-2026-62144, also rated 9.3, describes another authentication bypass and privilege escalation issue within management systems, though it has not yet been observed in active exploitation. Furthermore, CVE-2026-62145, with a CVSS score of 7.5, affects GaiaOS WebUI and enables local privilege escalation. While these two vulnerabilities are not currently exploited, they contribute to the overall security posture and should be addressed alongside the primary flaw.
Security teams should scrutinize logs and network telemetry for any communications involving the following indicators of compromise as part of their incident detection and response protocols:
| IP Address | Description |
|---|---|
| 151.241.99[.]207 | Observed in exploitation attempts |
| 151.241.99[.]233 | Observed in exploitation attempts |
| 158.62.198[.]182 | Suspicious activity linked to attacks |
| 192.142.10[.]99 | Potential attacker infrastructure |
| 139.28.37[.]250 | Associated with malicious traffic |
| 194.213.18[.]137 | Observed targeting vulnerable systems |
What You Should Do
- Apply the Latest Hotfix: Immediately deploy the Jumbo Hotfix released on July 22, 2026. This update contains critical security patches to remediate the vulnerability.
- Restrict Access: Limit SmartConsole and management interface access exclusively to trusted IP addresses. Ensure these interfaces are not exposed to the public internet.
- Enforce Firewall Rules: Verify that implied rules for control connections are enabled and enforce strict firewall protections.
- Limit GUI Client Access: Restrict GUI client access to only authorized networks.
- Monitor for IoCs: Actively review logs and network telemetry for any communication with the provided indicators of compromise (IoCs).
- Review Other Vulnerabilities: Address CVE-2026-62144 and CVE-2026-62145 as part of a comprehensive security update strategy, even if not currently exploited.
Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.
No Comment! Be the first one.