Check Point patches exploited SmartConsole flaw giving attackers full admin access

Check Point has fixed an actively exploited flaw in SmartConsole, the graphical admin panel used to manage its security products. CVE-2026-16232, rated 9.3, is an authentication bypass letting an unauthenticated remote attacker obtain a login token and authenticate with administrator privileges, after which they can alter security configuration and policy on a Security Management or Multi-Domain Management server. Exploitation requires the management server to be reachable from the internet with no restrictions on trusted GUI clients. The same update fixes a second critical authentication bypass and a Gaia Portal issue letting read-only users run commands as root.

Check

Install the July 22 Jumbo hotfix on Security Management and Multi-Domain Management servers, then restrict trusted GUI clients to approved addresses and firewall management access to known sources.

Affected

Organizations running Check Point Security Management or Multi-Domain Management with the console reachable from the internet (CVE-2026-16232); attackers gain administrator access and can rewrite the security policy protecting the network.

Fix

Apply the hotfix, limit trusted clients to specific addresses, keep management interfaces off the public internet, and review policy changes and administrator logins for unauthorized modifications.