Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass

Published:

29 juli 2026 om 10:58:27

Alert date:

29 juli 2026 om 12:01:29

Source:

thehackernews.com

Network Infrastructure, Zero-Day Vulnerabilities, Identity & Access, Security Tools

A critical authentication bypass vulnerability (CVE-2026-16232, CVSS 9.3) has been identified in Check Point Security Management Server and Multi-Domain Security Management Server (MDS). The flaw resides in the SmartConsole login process and has been actively exploited in the wild. Cybersecurity researchers have released additional technical details and a public proof-of-concept (PoC) following the patch release. The high CVSS score and active exploitation make this a critical issue for organizations using Check Point security management products. Administrators are urged to apply the available patch immediately to mitigate risk of unauthorized access.

Technical details

CVE-2026-16232 is a critical authentication bypass vulnerability (CVSS 9.3) in Check Point SmartConsole's login process. The root cause is a 'broken trust boundary' in the application authentication path. A vulnerable server accepts an attacker-supplied Secure Internal Communication (SIC) distinguished name (DN) as the identity of a remote application, instead of binding that identity to the authenticated remote peer certificate DN returned by the 'getCertificateDnName()' function. An attacker can read the management server's own SIC DN during unauthenticated bootstrap communication, then authenticate as a remote application by replaying that server's DN, obtaining an application login token, and minting a new SmartConsole single sign-on (SSO) ticket via the forged application session. This grants full administrative privileges without valid credentials. The patch enforces use of the authenticated remote peer certificate DN and adds an empty identity check to prevent remote application login when no authenticated SIC identity exists. Rapid7 researcher Stephen Fewer published a public PoC Python script on GitHub to validate whether a target is vulnerable or patched.

Mitigation steps:

1. Apply the Jumbo Hotfixes released by Check Point on July 22, 2026, to remediate CVE-2026-16232 as soon as possible. 2. Restrict Trusted Clients configuration on the Management Server to limit network access and reduce attack surface. 3. Ensure network access to the Management Server is tightly controlled and limited to authorized clients only. 4. Use Rapid7's public PoC Python script (https://github.com/sfewer-r7/CVE-2026-16232) to validate whether your target systems are vulnerable or already patched. 5. Monitor for unauthorized SmartConsole login activity or unexpected administrative configuration changes as indicators of potential exploitation.

Affected products:

Check Point Security Management Server
Check Point Multi-Domain Security Management Server (MDS)
Check Point SmartConsole