Critical 9.3
KEV-listed
CVE-2026-16232
Check Point SmartConsole Zero-Day Exploited with Public PoC Release
Vendor / product: Check Point SmartConsole, Security Management Server, Multi-Domain Security Management Server (MDS)
Event date: 2026-07-22
Public PoC: Yes
First tracked by RiskWire: 2026-07-28
CISA KEV catalog
Added to KEV
Federal remediation due
2026-07-25 (57 days overdue)
Ransomware campaign use
Unknown
CISA description
Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Sources & citations (6)
- Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass thehackernews.com · 2026-07-29
- Check Point SmartConsole Zero-Day Lets Unauthenticated Attackers Gain Full Admin Access gbhackers.com · 2026-07-29
- Check Point Authentication Bypass Flaw Enables Full Compromise of Security Management System cybersecuritynews.com · 2026-08-04
- Check Point SmartConsole 0-Day Exploited to Gain Full Administrator Access cybersecuritynews.com · 2026-07-29
- Check Point SmartConsole Critical Vulnerability (CVE-2026-16232): Admin Auth Bypass Exploited archyde.com · 2026-08-01
- Critical Check Point Flaw Lets Unauthenticated Attackers Execute Commands on Management Servers gbhackers.com · 2026-08-04
References
See CVE-2026-16232 in context
RiskWire tracks every exploited CVE this week, cross-referenced against CISA KEV with federal remediation deadlines. Filtered to your vendor stack.
Book a 20-min demo →