CVE-2026-16232, CoreCVE

Back Back to CVE browser

CRITICAL KEV

Authentication Bypass in the SmartConsole Login Process Using an Application Token

Published Jul 22, 2026 ·Due Jul 25, 2026

9.3

CRITICAL

CVSS 4.0

EPSS 77.97%

Description

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.

Affected products

Vendor Check Point Product Multi-Domain Security Management Default
n/a
- Version
  R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30
  Status
  affected
  Constraints
  -
- Version
  R81.20 with Jumbo Hotfix Take 158 or below
  Status
  affected
  Constraints
  -
- Version
  R82 with Jumbo Hotfix Take 118 or below
  Status
  affected
  Constraints
  -
- Version
  R82.10 with Jumbo Hotfix Take 36 or below
  Status
  affected
  Constraints
  -
Vendor Check Point Product Quantum Security Management Default
n/a
- Version
  R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30
  Status
  affected
  Constraints
  -
- Version
  R81.20 with Jumbo Hotfix Take 158 or below
  Status
  affected
  Constraints
  -
- Version
  R82 with Jumbo Hotfix Take 118 or below
  Status
  affected
  Constraints
  -
- Version
  R82.10 with Jumbo Hotfix Take 36 or below
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Check Point

Multi-Domain Security Management

n/a

Version	Status	Constraints
R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30	affected	-
R81.20 with Jumbo Hotfix Take 158 or below	affected	-
R82 with Jumbo Hotfix Take 118 or below	affected	-
R82.10 with Jumbo Hotfix Take 36 or below	affected	-

Check Point

Quantum Security Management

n/a

Version	Status	Constraints
R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30	affected	-
R81.20 with Jumbo Hotfix Take 158 or below	affected	-
R82 with Jumbo Hotfix Take 118 or below	affected	-
R82.10 with Jumbo Hotfix Take 36 or below	affected	-

Remediation

No remediation recorded yet.

Metrics

77.97% 0.77972

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.77972

Score over time

Jul–Oct 2026

EPSS v5

Percentile over time

EPSS v5

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	77.97% (0.77972)	99.56th	v5 (v2026.06.15)
Aug 30, 2026	72.05% (0.72051)	99.38th	v5 (v2026.06.15)
Aug 26, 2026	73.99% (0.73994)	99.44th	v5 (v2026.06.15)
Aug 24, 2026	89.12% (0.89118)	99.77th	v5 (v2026.06.15)
Aug 11, 2026	73.30% (0.73296)	99.41th	v5 (v2026.06.15)
Aug 2, 2026	71.39% (0.71391)	99.35th	v5 (v2026.06.15)
Jul 29, 2026	69.97% (0.69969)	99.31th	v5 (v2026.06.15)
Jul 24, 2026	12.68% (0.12685)	95.84th	v5 (v2026.06.15)
Jul 23, 2026	1.07% (0.01074)	61.46th	v5 (v2026.06.15)

Weaknesses (1)

CWE-287

Improper Authentication

References (2)

https://support.checkpoint.com/results/sk/sk185169
MitigationPatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232
government-resourceUS Government Resource

Link	Providers	Tags
https://support.checkpoint.com/results/sk/sk185169		MitigationPatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232		government-resourceUS Government Resource