Critical Check Point SmartConsole CVE-2024-24957 Lets Attackers Gain Admin Access

Key Takeaways

• A critical authentication bypass (CVE-2026-16232) in Check Point SmartConsole was actively exploited as a zero-day.
• The vulnerability grants unauthenticated attackers full administrative access to Security Management Server and Multi-Domain Security Management Server (MDS).
• Successful exploitation requires network access to the management server and a less restrictive “Trusted Clients” configuration.
• Check Point has released Jumbo Hotfix updates to address the flaw.

Critical Check Point SmartConsole Flaw Exploited in the Wild

A severe authentication bypass vulnerability, identified as CVE-2026-16232, has been discovered in Check Point’s SmartConsole, with evidence of active exploitation prior to the availability of patches. This critical flaw allows an unauthenticated attacker, with network access to the Management Server, to gain complete administrative control over affected Security Management Server and Multi-Domain Security Management Server (MDS) instances through the SmartConsole management interface.

Check Point issued a security advisory detailing the issue on July 22, 2026. Concurrently, Rapid7 Labs independently verified in-the-wild exploitation and subsequently released a public proof-of-concept (PoC) to assist organizations in assessing their exposure and validating their defenses.

Understanding the Vulnerability

The core of CVE-2026-16232 resides within the SmartConsole login process. An attacker capable of reaching the Management Server via the network can exploit this flaw to acquire an application login token. This token then permits authentication through SmartConsole with full administrator privileges, enabling them to alter security policies or system configurations.

For successful exploitation, attackers need network connectivity to the management plane. Additionally, the “Trusted Clients” setup must not be configured to tightly restrict GUI clients. Rapid7’s analysis indicated that this less restrictive configuration is often the default setting, increasing the potential attack surface.

Given that this vulnerability was actively exploited before public disclosure, organizations operating exposed management servers face a heightened risk until they apply the necessary patches and implement stricter access controls.

Technical Analysis of the Bypass

According to Rapid7’s in-depth analysis, the root cause of the vulnerability is a breakdown in the trust boundary during application authentication. The vulnerable server incorrectly accepts an attacker-provided Secure Internal Communication (SIC) distinguished name as the identity of a remote application. Instead of binding this identity to the authenticated remote peer certificate returned by the platform, the server trusts the attacker’s input.

The attack chain leverages this flaw by allowing an attacker to first obtain the management server’s own SIC DN during unauthenticated bootstrap traffic. This DN is then replayed in a crafted application certificate bind. Upon successful binding, the attacker receives an application token, which is subsequently used to request a SmartConsole single sign-on ticket from the legacy management service. This ticket is then redeemed via the newer CPM SOAP API, establishing a full SmartConsole session with administrative rights.

SmartConsole management traffic operates across two generations of services. The legacy FWM/CPMI service, running on TCP port 18190, manages SIC-based trust and older FwSet-style communications. In parallel, the CPM/DLE stack on TCP port 19009 exposes SOAP operations under the /cpmws/ endpoint and relies on session headers post-login.

The exploit skillfully chains these two services. It abuses the FWM/CPMI service to assert an application identity and mint a token. This token then facilitates the generation and redemption of a SmartConsole SSO ticket, bridging the legacy and modern service interactions.

Once the ticket is redeemed, the attacker possesses session identifiers that enable privileged operations, including retrieving server details and enumerating administrator accounts. Defenders should be aware that audit logs may display “Authentication method: application token,” which serves as a crucial indicator of compromise.

Rapid7 reproduced the issue on Check Point R81.20 and R82.10 builds and has made a PoC script available on GitHub to help organizations verify whether their systems are vulnerable or patched.

The vendor’s fixes address the attack by modifying remote application authentication to use the certificate-bound peer DN instead of an untrusted, caller-supplied name. Mismatches or missing SIC identities are now rejected. On patched systems, the forged bind attempt will fail, and the PoC script will correctly report the host as not vulnerable.

What You Should Do

• Immediately apply Check Point’s recommended Jumbo Hotfix updates to all affected Security Management Server and Multi-Domain Security Management Server (MDS) instances.
• Restrict management-plane access to SmartConsole to only trusted networks and specific, authorized client machines.
• Review audit logs for any suspicious authentications, particularly those showing “Authentication method: application token” as a potential indicator of compromise.
• Ensure your “Trusted Clients” configuration is set to tightly restrict GUI clients to minimize the attack surface.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.