744
Hey there! Check Point has recently confirmed some active attacks targeting a critical SmartConsole authentication bypass. This vulnerability affects its Security Management and Multi-Domain Management servers, allowing unauthenticated attackers to gain full administrator access to the management plane. The bug, known as CVE-2026-16232, has a CVSS score of 9.3.
Rapid7 released a technical breakdown of the bug on July 22nd, the same day Check Point issued emergency Jumbo Hotfixes. A Python proof-of-concept has also been made public on GitHub, allowing users to check if a target is patched. This combination of a confirmed attack in the wild and a public exploit script is definitely concerning for defenders.
Understanding the SmartConsole authentication bypass
The vulnerability lies in how SmartConsole’s login process manages Secure Internal Communication (SIC) identities. Instead of binding an application’s identity to the authenticated certificate, the server accepts an attacker-supplied SIC distinguished name without verification. This flaw can be exploited by replaying the server’s SIC DN in a forged application certificate bind, leading to the attacker gaining administrator access.
Exploiting this vulnerability requires network access to the management server’s IP address, particularly when Trusted Clients is left open. Rapid7 Labs successfully reproduced the attack on R81.20 and R82.10 builds, with Check Point confirming that older branches are also affected.
Real-world impact and urgency
Check Point has identified active exploitation of this vulnerability in a handful of customers’ systems. The exposure is limited to configurations where Management is exposed directly to the internet without IP restrictions. The US Cybersecurity and Infrastructure Security Agency (CISA) has classified this as a known exploited vulnerability, setting a tight deadline for remediation.
Aside from CVE-2026-16232, Check Point also addressed two related bugs in the same emergency update. It’s crucial for organizations to apply the Jumbo Hotfix to ensure all vulnerabilities are patched comprehensively.
Immediate action and best practices
Organizations affected by this SmartConsole authentication bypass should prioritize applying the emergency patch. Check Point has specified the fixed builds for different releases, emphasizing the importance of isolating management servers from untrusted networks and following security best practices.
Rapid7’s PoC tool can help security teams quickly assess the vulnerability status of their systems, enabling prompt action to mitigate risks. This incident serves as a reminder of the critical importance of securing firewall management consoles and regularly verifying patch status.
