Israeli cybersecurity firm Check Point Software has addressed an actively exploited zero-day flaw in the company's SmartConsole graphical user interface (GUI) admin panel.

Check Point Software released emergency hotfixes for CVE-2026-93616, a critical path traversal flaw in Security Management Server products that allowed unauthenticated attackers to upload and run arbitrary scripts. The company said the issue is being exploited in the wild and urged customers to patch immediately or apply temporary mitigations while checking for signs of compromise. #CheckPoint #CVE-2026-93616 #SecurityManagementServer #SmartConsole

U.S. CISA adds SharePoint and Check Point vulnerabilities to its Known Exploited Vulnerabilities catalog..

Check Point addressed a critical authentication bypass flaw, tracked as CVE-2026-16232, in SmartConsole that is being actively exploited.

Check Point patches actively exploited CVE-2026-16232, a SmartConsole auth bypass that grants full admin access on exposed management servers.

Check Point's SmartConsole flaw bypasses authentication, but details remain vague and the evidence weak. Here's a skeptical look at the situation.

Israeli cybersecurity firm Check Point Software has addressed an actively exploited zero-day flaw in the company's SmartConsole graphical user interface (GUI) admin panel.

Weitere Sicherheitslücken in SharePoint stehen unter Beschuss. Auch Check Point SmartConsole wird derzeit attackiert.

Researchers warned the vulnerability offers an attacker the ability to make key changes to security configurations.

A critical authentication bypass in SmartConsole that was actively exploited as a zero-day before patches were available. Tracked as CVE-2026-16232, the flaw affects Security Management Server and Multi-Domain Security Management Server (MDS) and can give an unauthenticated attacker full administrator access through the SmartConsole management interface. On July 22, 2026, Check Point published a security advisory detailing the issue, while Rapid7 Labs confirmed exploitation in the wild and released a public proof-of-concept to help defenders validate exposure. CVE-2026-16232 sits in the SmartConsole login path. An attacker with network reach to the Management Server can obtain an application login token, use it to authenticate through SmartConsole with full administrator privileges, and then change security policy or configuration. Check Point Zero-Day PoC Released Successful abuse depends on network access to the management plane and a Trusted Clients setup that does not tightly restrict GUI clients, a condition Rapid7 observed as default in testing. Because the bug was already under attack at disclosure, organizations running exposed management servers face elevated risk until they patch and harden access. According to Rapid7’s analysis, the root cause is a broken trust boundary in application authentication. A vulnerable server accepts an attacker-supplied Secure Internal Communication (SIC) distinguished name as the identity of a remote application instead of binding that identity to the authenticated remote peer certificate returned by the platform. Attack Chain (Source: Rapid7) An attacker can learn the management server’s own SIC DN during unauthenticated bootstrap traffic, replay it in a forged application certificate bind, receive an application token, and then request a SmartConsole single sign-on ticket from the legacy management service. That ticket is redeemed over the newer CPM SOAP API, producing a full SmartConsole session with administrator rights. SmartConsole management traffic spans two generations of services. The legacy FWM/CPMI service on TCP 18190 handles SIC-based trust and older FwSet-style exchanges, while the CPM/DLE stack on TCP 19009 exposes SOAP operations under /cpmws/ and relies on session headers after login. The exploit chains both: it abuses FWM/CPMI to claim an application identity and mint a token, then uses that session to generate and redeem a SmartConsole SSO ticket. Once redeemed, the attacker holds session identifiers that support privileged operations, including reading server details and enumerating administrator accounts. Audit logs may show “Authentication method: application token,” which defenders can treat as a useful indicator of compromise. Rapid7 reproduced the issue on affected R81.20 and R82.10 builds and published a PoC script on GitHub that checks whether a target is vulnerable or patched. Vendor fixes block the attack path by ensuring remote application authentication uses the certificate-bound peer DN rather than an untrusted caller-supplied name, and by rejecting mismatches or missing SIC identities. On patched systems, the forged bind fails, and the PoC reports the host as not vulnerable. Organizations should apply Check Point’s recommended Jumbo Hotfix updates immediately, restrict management-plane access to trusted networks and clients, and review audit logs for suspicious application-token authentications.  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. ->  Integrate ANY.RUN With Your SOC  Now . The post Check Point SmartConsole 0-Day Exploited to Gain Full Administrator Access – PoC Released appeared first on Cyber Security News .

Root cause technical analysis of CVE-2026-16232, an authentication bypass in the SmartConsole login process affecting Check Point Security Management Server and Multi-Domain Security Management Server...

U.S. CISA adds SharePoint and Check Point vulnerabilities to its Known Exploited Vulnerabilities catalog..

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successfu…

Vulnerability-Lookup - Fast vulnerability lookup correlation from different sources.

Vulnerability-Lookup - Fast vulnerability lookup correlation from different sources.

With Check Point warning that attackers are actively exploiting the critical SmartConsole authentication bypass flaw (CVE-2026-16232) to obtain full administrative privileges, this is another reminder that security infrastructure itself has become a prime target.  The vulnerability has already been exploited in the wild, prompting emergency patch guidance and inclusion in CISA's Known Exploited Vulnerabilities catalog which can be found…