Executive Summary
CVE-2026-16232 is an improper authentication vulnerability (CWE-287) in Check Point SmartConsole, the management GUI used to administer Check Point security gateways, firewalls, and VPN products. An unauthenticated remote attacker who can reach the Management Server IP address over the network can exploit this flaw to obtain an application login token and use it to authenticate to SmartConsole with full administrative privileges. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on July 22, 2026, with a mandatory remediation deadline of July 25, 2026 for federal agencies.
Check Point confirmed active exploitation affecting a limited number of customers. The impact of full SmartConsole admin access is severe: an attacker gains the ability to modify security policies, reconfigure VPN settings, alter logging configurations, and potentially pivot to managed security gateways.
Affected Versions
The vulnerability affects Check Point Security Management products across a wide version range:
End-of-support versions (no patch available):
- R77.30 through R81.10
Supported versions (Jumbo Hotfix available):
- R81.20 — Jumbo HFA Take 158 or later
- R82 — Jumbo HFA Take 118 or later
- R82.10 — Jumbo HFA Take 36 or later
Organizations running end-of-support versions have no patch path available and must rely on compensating controls or upgrade the management platform.
Vulnerability Details
The flaw lies in the authentication flow of the SmartConsole login process when using application tokens. SmartConsole supports multiple authentication methods, including username/password and application tokens — pre-generated credentials intended for API access and automated management workflows. The vulnerability allows an attacker to obtain one of these application login tokens through an unauthenticated request to the Management Server.
Check Point’s advisory (sk185169) describes the root cause as an improper authentication condition in how the server processes token requests during the login handshake. The specific mechanism for initial token acquisition has not been fully detailed in public disclosures, but successful token retrieval then allows complete authentication to SmartConsole as an administrator. Two conditions must be met for exploitation:
- The Management Server must be reachable over the network from the attacker’s source — typically meaning internet exposure of the management IP, or access from a compromised network segment.
- The Trusted Clients configuration must be set to “Any” (the default in some configurations), meaning there is no restriction on which IP addresses are permitted to connect as GUI clients.
Organizations that have restricted Trusted Clients to specific IP addresses or subnets effectively limit the attack surface, since even a valid application token cannot be used from an untrusted source address.
The attack does not require any prior credential compromise, social engineering, or access to an existing session. It is a network-accessible, pre-authentication vulnerability against a management plane component.
Exploitation in the Wild
Check Point confirmed active exploitation in its security advisory, describing the impact as affecting “a very small number of customers” at time of disclosure. The company did not publicly attribute exploitation to a specific threat actor or campaign. Given that SmartConsole controls firewall and VPN policy across enterprise perimeters, exploitation is high-value — successful compromise gives attackers the ability to manipulate the policies governing all downstream traffic, insert backdoor rules, or disable logging on targeted gateways.
Check Point provided five attacker IP addresses observed during exploitation:
151.241.99.207151.241.99.233158.62.198.182192.142.10.99139.28.37.250
Historical context: Check Point Security Gateways have been a persistent target for nation-state and financially motivated threat actors. The 2024 CVE-2024-24919 VPN credential disclosure vulnerability was exploited by multiple threat groups including those with ties to ransomware operations. Management plane vulnerabilities are particularly valuable because compromising the management server can provide persistent access that survives firewall policy redeployment.
Patch and Remediation
Apply the Jumbo Hotfix appropriate for your release stream as the primary remediation:
- R82.10: Jumbo HFA Take 36 or later
- R82: Jumbo HFA Take 118 or later
- R81.20: Jumbo HFA Take 158 or later
For versions R81.10 and earlier, no patch is available. Organizations running these versions should prioritize the following compensating controls:
Restrict Trusted Clients. In SmartConsole or through the management API, restrict the list of permitted GUI clients to specific trusted IP addresses or subnets. Removing the “Any” setting from Trusted Clients breaks the attack path even if the Management Server is otherwise reachable.
Network-level isolation. Place the Management Server behind a firewall or ACL that restricts inbound access to the management port (TCP 18190) to administrative workstations or jump hosts only. Internet-facing management servers are a configuration that should be avoided regardless of this vulnerability.
Upgrade the platform. Organizations on end-of-support releases should treat this as a forcing function for upgrade planning. Running unsupported management software in production is an ongoing risk beyond this specific CVE.
Check Point published emergency hardening guidance alongside the advisory at sk185169.
Detection
Audit log review: The primary detection signal is authentication events using the application token method from unexpected sources. Search management server audit logs for events containing Authentication method: application token associated with source IP addresses not in your known administrative IP range.
Network traffic analysis: Look for connection attempts to TCP port 18190 (the SmartConsole management port) from external or unexpected IP addresses. Pre-authentication probing may precede a successful token retrieval attempt.
IOC matching: Block and alert on the five attacker IPs confirmed by Check Point: 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, 139.28.37.250. Note that attribution of these IPs to this campaign does not preclude other actors using different infrastructure.
Threat hunting query (conceptual): Pull auth events from the SmartConsole audit database, group by authentication method, and filter for application token entries. Cross-reference the source IP against your Trusted Clients list and flag any that do not appear there.
Policy change auditing is also warranted post-detection: if exploitation occurred, review all security policy changes, administrator account additions, and logging configuration changes in the window following any suspicious authentication events.