CVE-2026-16232

Description

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.

References

https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-point-smartconsole-authentication-bypass-cve-2026-16232/

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232

https://support.checkpoint.com/results/sk/sk185169

Details

Source: Mitre, NVD

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

CVSS v3

CVSS v4

Vulnerability Watch

Tenable Research has classified this CVE under the following Vulnerability Watch classification, which includes active and historical (inactive) classifications. You can learn more about these classifications on our blog.

Vulnerability of Interest