Check Point patches actively exploited SmartConsole authentication bypass flaw
Critical authentication bypass flaw grants full admin access to attackers.
1Critical Vulnerability and Impact
Check Point has addressed a critical authentication bypass flaw tracked as CVE-2026-16232. This vulnerability allows attackers to gain full administrative access via SmartConsole and modify security policies. The flaw is currently under active exploitation, affecting a limited number of customers.
2Affected Products
The vulnerability impacts Check Point's Security Management Server and Multi-Domain Security Management Server (MDS) versions from R77.30 to R82.10. Management servers exposed to the internet with disabled trusted client restrictions are particularly vulnerable to exploitation.
3Attacker IP Addresses
Check Point has shared the IP addresses used by attackers. These addresses can help security teams detect potential breaches by reviewing logs. Known attacker IPs include 151.241.99.207, 158.62.198.182, and 194.213.18.137 among others.
4Additional Security Flaws
Alongside CVE-2026-16232, Check Point patched two other vulnerabilities. One allows remote execution of administrative actions, while the other enables privilege escalation in the Gaia Portal.
5Recommended Mitigations
Organizations should restrict management server access via firewall rules and limit trusted clients to approved IP addresses. Installing the July 22 Jumbo hotfix and regularly reviewing logs are also strongly recommended.
6Conclusion and Importance
This flaw highlights the vulnerability of critical systems in the cybersecurity landscape. Timely application of security updates and strict access controls are vital in preventing similar attacks and protecting organizational assets.