Check Point SmartConsole Pre-Auth Authentication Bypass via App Token (CVE-2026-16232)

Vulnerability Overview Vulnerability Name: CVE-2026-16232 Description: An attacker can obtain full administrative privileges and modify security policies and configurations by obtaining an application token and exploiting the SmartConsole login process to bypass authentication. Impact: This vulnerability affects a very small number of customers but has been actively exploited. Affected Scope Affected Products: - Security Management Server - Multi-Domain Security Management Server (MDS) Affected Versions: - R77.30 (EOS) - R80 (EOS) - R80.10 (EOS) - R80.20 (EOS) - R80.30 (EOS) - R80.40 (EOS) - R81 (EOS) - R81.10 (EOS) - R81.20 - R82 - R82.10 Remediation Measures 1. Follow Check Point hardening best practices guide. 2. Restrict trusted clients (GUI clients) to trusted IP addresses/subnets: - In SmartConsole, navigate to Management & Settings > Access Permissions > Trusted Clients. - Double-click the client you wish to edit. - In the opened Trusted Clients configuration window, modify the settings as needed. Ensure that "Any" is not selected as the type. - Click OK. 3. Protect management access via firewall: Restrict access to trusted IP addresses and verify that the implicit rule for control connections is enabled. This will create an implicit rule that blocks unauthorized IP addresses from accessing management functions. How to Identify Attacks 1. In SmartConsole, navigate to Logs & Monitors > Logs & Events. Search for events where the source or destination IP matches known attacker IPs. - Attacker IP Addresses: - 151.241.99.207 - 151.241.99.233 - 158.62.198.182 - 192.142.10.99 - 139.28.37.250 - SmartConsole Query: 2. In SmartConsole, navigate to Logs & Monitors > Logs & Events > Audit Log View. Search for the query: "Authentication method: application token". Solution The issue has been fixed. The fix is included in the following versions: - R82.10 Jumbo Hotfix Accumulator starting from Take 36 - R82 Jumbo Hotfix Accumulator starting from Take 118 - R81.20 Jumbo Hotfix Accumulator starting from Take 158

Goal Reached Thanks to every supporter — we hit 100%!

Check Point SmartConsole Pre-Auth Authentication Bypass via App Token (CVE-2026-16232)