Check PointExploited incident
Check Point SmartConsole login authentication bypass via application token
CVE-2026-16232Critical, CVSS 9.3In CISA's Known Exploited Vulnerabilities catalog since 22 Jul 2026
- Exploited before a fix
Response
- Silence
- 0h First public report to first vendor statement
- Exposure
- same day First public report to first fix
- Follow-through
- same day First public report to a fix for every supported version
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Fixed when disclosed
- Date only, no time of day
Timeline and evidence
Open a moment to see its source and archived quote.
First public report
CVE record CVE-2026-16232 (CNA: Check Point)CuratedQuote verified
"assignerShortName":"checkpoint","dateReserved":"2026-07-19T12:14:17.233Z","datePublished":"2026-07-22T13:53:09.830Z"
Check Point's disclosure (sk185169, which said the bug was exploited against a handful of customers) is the earliest public signal found. The record's description now reads 'Check Point is aware that this vulnerability is being exploited'; the record was updated 2026-08-10, so that sentence may have been added later.
- Source
- CVE record CVE-2026-16232 (CNA: Check Point) cve record
- Recorded time
- Precision
- To the minute
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:93c4177cd8e9be41…- Used in metrics
- Yes
5 more sources for this moment
CISA KEV (CVE-2026-16232)ClaimedQuote verified22 Jul 2026
Check Point SmartConsole Improper Authentication Vulnerability
Added to CISA's KEV catalog on 2026-07-22.
- Source
- CISA KEV (CVE-2026-16232) kev
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:ef8fffede5c47200…- Used in metrics
- No, kept for the record
CVE.org record CVE-2026-16232ClaimedQuote verified22 Jul 2026, 13:53 UTC
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with
CVE record published.
- Source
- CVE.org record CVE-2026-16232 cve record
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:93c4177cd8e9be41…- Used in metrics
- No, kept for the record
Bluesky postClaimedQuote not checked yet22 Jul 2026, 17:30 UTC
Check Point confirms CVE-2026-16232, a SmartConsole authentication bypass, is exploited in the wild. Apply the July 22 jumbo hotfix now.
Earliest third-party post we hold.
- Source
- Bluesky post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
Mastodon postClaimedQuote not checked yet22 Jul 2026, 17:30 UTC
Check Point confirms CVE-2026-16232, a SmartConsole authentication bypass, is exploited in the wild. Apply the July 22 jumbo hotfix now. # CheckPoint # CVE202616232 # SmartConsole # AuthBypass # ExploitedInTheWild
Earliest third-party post we hold.
- Source
- Mastodon post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
Rapid7 Emergent Threat ResponseCuratedQuote verified23 Jul 2026
Check Point has confirmed that CVE-2026-16232 is being actively exploited in the wild, affecting what the vendor describes as a small number of customers.
Post dated 'Jul 23, 2026'.
- Source
- Rapid7 Emergent Threat Response research
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:2b85cda0e213e434…- Used in metrics
- No, kept for the record
Vendor statement
at disclosure
CVE record CVE-2026-16232 (CNA: Check Point)CuratedQuote verified
"datePublished":"2026-07-22T13:53:09.830Z"
sk185169's text is only in a page script (__NEXT_DATA__), not visible text; its metadata shows dateCreated 2026-07-19.
- Source
- CVE record CVE-2026-16232 (CNA: Check Point) cve record
- Recorded time
- Precision
- To the minute
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:93c4177cd8e9be41…- Used in metrics
- Yes
First workaround
No official mitigation found yet.
First fix
date onlysame day
Rapid7 Emergent Threat ResponseCuratedQuote verified
Check Point released Jumbo Hotfixes on July 22, 2026, to remediate CVE-2026-16232, CVE-2026-62144, and CVE-2026-62145.
- Source
- Rapid7 Emergent Threat Response research
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:2b85cda0e213e434…- Used in metrics
- Yes
Fixed for all versions
date onlysame day
Rapid7 Emergent Threat ResponseCuratedQuote verified
R82.10: fixed in Jumbo Hotfix Take 36 and later
Rapid7 lists R82.10 Take 36, R82 Take 118 and R81.20 Take 158 as fixed by the 2026-07-22 Jumbo Hotfixes; R81.10 and older are end of support with 'no fix specified' and are not counted.
- Source
- Rapid7 Emergent Threat Response research
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:2b85cda0e213e434…- Used in metrics
- Yes
Send this to your boss
Check Point management servers: exploited admin login bypass, fixed Jul 22
Attackers used a flaw in Check Point's SmartConsole login to get full admin access to exposed firewall management servers; fixes shipped on 22 July 2026.
In plain words
The server we use to manage our Check Point firewalls had a flaw that let outsiders log in as an administrator and change firewall rules, and Check Point saw it used against a few customers. Check Point released fixes on 22 July 2026. If we run our own Check Point management server, we need the hotfix installed, internet access to it closed, and a review of recent policy changes.
What happened and who is affected
What happened
On 22 July 2026 Check Point disclosed CVE-2026-16232, an authentication bypass in the SmartConsole login process that lets an unauthenticated attacker obtain an application token and log in with full administrative rights, then change firewall policy. Check Point said a handful of customers whose management servers were reachable from the internet without Trusted Client restrictions had been attacked. Jumbo Hotfixes for R82.10, R82 and R81.20 were released the same day.
Who is affected
Security Management Server and Multi-Domain Security Management Server on R82.10 below JHF Take 36, R82 below Take 118, R81.20 below Take 158, and end-of-support R81.10 and older (R81, R80.x, R77.30).
Affected products
- Security Management Server
- Multi-Domain Security Management Server
How we built this timeline
Zero-day: Check Point disclosed exploitation and fixes together on 22 Jul 2026 (Rapid7, Cybersecurity Dive 24 Jul 2026). Rapid7 says the same Jumbo Hotfixes fixed CVE-2026-62144 and CVE-2026-62145 (not known exploited, not in KEV); they are not added to cve_ids because it could not be confirmed they share sk185169. sk185169's embedded data (not quotable) also gives a mitigation: limit Trusted Clients to trusted IPs and protect management access with the firewall; no visible-text source dated that mitigation to disclosure, so no Workaround moment is recorded.
CVSS: Check Point 9.3 (CVSS 4.0); CISA/Rapid7 cite 9.1.