Check Point Patches Exploited Smart Console Flaw Allowing Full Admin Access
Summary: Check Point released security updates for a critical authentication bypass, CVE-2026-16232 (CVSS 9.3), in the SmartConsole login process that lets an unauthenticated remote attacker obtain an application login token and authenticate with full administrative privileges. Check Point's Lotem Finkelstein said a handful of customers have been targeted and notified, and the flaw only affects Management exposed directly to the internet without IP restrictions or Trusted Clients limits.
What's compelling: An attacker who reaches an unrestricted Management Server can rewrite security policies and configurations, and CISA's KEV listing gives federal civilian agencies until July 25, 2026 to apply the July 22 Jumbo hotfix.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-16232CVE-2026-62144
- Related
- ⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, Click Fix Lures and More Cyber Risks ·CVE-2026-16232: Check Point Smart Console Improper Authentication Vulnerability Known Exploited Vulnerabilities · Jul 22, 2026