CVE-2026-16232 is an authentication-bypass vulnerability in the Check Point SmartConsole login process that lets an unauthenticated remote attacker obtain an application login token and authenticate with full administrative privileges over a Multi-Domain or Quantum Security Management Server, and both NVD and Check Point confirm it has been exploited in the wild, though Check Point describes the known impact as affecting "a very small number of customers."
Vulnerability summary
| Vulnerability ID | CVE-2026-16232 |
|---|---|
| CVSS score | 9.8 |
| EPSS score | 0.0352 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2026-07-22T14:17:15.513 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| Check Point Multi-Domain Security Management | cpe:2.3:a:checkpoint:multi-domain_security_management:*:*:*:*:*:*:*:* | R77.30 through R82.10 per NVD's CPE match data, which lists dozens of specific R81.20, R82 and R82.10 Jumbo Hotfix Takes as individually vulnerable; Check Point's sk185169 advisory (linked from NVD and CISA) specifies the exact fixed Take per branch but returned no readable content when fetched this run |
| Check Point Quantum Security Management | cpe:2.3:a:checkpoint:quantum_security_management:*:*:*:*:*:*:*:* | R77.30 through R82.10 per NVD's CPE match data, which lists dozens of specific R81.20, R82 and R82.10 Jumbo Hotfix Takes as individually vulnerable; Check Point's sk185169 advisory (linked from NVD and CISA) specifies the exact fixed Take per branch but returned no readable content when fetched this run |
What this means
CVE-2026-16232 is an improper authentication vulnerability (CWE-287) in the login process of Check Point SmartConsole. NVD's description is unusually direct about real-world impact: "An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers" (NVD).
NVD's own analysis assigns a Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, full impact to confidentiality, integrity and availability. Check Point's own CNA submission separately scores it CVSS v4.0 9.3 (NVD).
NVD's structured CPE match data lists both Check Point Multi-Domain Security Management and Quantum Security Management as affected from R77.30 up through numerous individually-enumerated R81.20, R82 and R82.10 Jumbo Hotfix Takes — reflecting that Check Point ships fixes as hotfix Takes on top of a base release rather than as a single new version number. Check Point's own advisory, sk185169 (linked from both NVD's and CISA's references as the Mitigation/Patch/Vendor Advisory source), would normally specify the exact fixed Take per branch, but it renders its content client-side behind the support portal and returned no readable text when fetched this run — so the precise per-branch fixed Take is not repeated here beyond what NVD's CPE data shows, and administrators should consult that sk article directly for the Take number to install. NVD's description notes the key mitigating control: exploitation requires internet access to the Management Server IP and a configuration that does not restrict Trusted Clients (NVD; Check Point sk185169).
CISA added CVE-2026-16232 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-07-22, the same day NVD published the record, with an unusually short required-action due date of 2026-07-25 and forensic-triage flagged "Yes"; known ransomware-campaign use is listed as "Unknown" (catalog confirmed live this run, matched by exact cveID string against the raw KEV feed) (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.0352 (89.19th percentile) (FIRST EPSS).
Given NVD's and Check Point's own confirmation of active exploitation, any Multi-Domain or Quantum Security Management Server reachable from the internet should have Trusted Clients restricted immediately and be updated to the fixed Jumbo Hotfix Take identified in sk185169, even though this page could not independently verify that Take number from the vendor page's rendered content.
Evidence
- Unauthenticated remote attacker can obtain a SmartConsole login token and authenticate with full administrative privileges to modify security policies and configurations; Check Point confirms exploitation affecting a very small number of customers. — NVD
- NVD Primary CVSS v3.1 score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; Check Point's own CNA submission scores it CVSS v4.0 9.3. — NVD
- Affected products are Multi-Domain Security Management and Quantum Security Management, R77.30 through numerous individually-listed R81.20/R82/R82.10 Jumbo Hotfix Takes per NVD's CPE match data. — NVD
- Check Point's sk185169 advisory is the vendor Mitigation/Patch source per NVD and CISA references, but rendered no readable text when fetched this run. — Check Point sk185169
- Added to the CISA KEV catalog on 2026-07-22, due date 2026-07-25, forensic triage required; known ransomware campaign use listed as Unknown. — CISA KEV
- EPSS score is 0.0352 (89.19th percentile) as of 2026-10-29. — FIRST EPSS