CVE-2026-16232: Check Point SmartConsole Improper Authentication Vulnerability

Patch now

CRITICAL 9.8EXPLOITEDREMOTEUPGRADEUPGRADE

CVE-2026-16232 is a critical-severity flaw (CVSS 9.8) affecting multi-domain security management, quantum security management, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restri

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
Exploited in the wild (CISA KEV)
Public exploit reference
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	78.0% (top 1%)
CISA exploited list	Yes, fix due 2026-07-25
Weakness	CWE-287
Published	2026-07-22
Last modified	2026-10-24

Publisher (CNA): Check Point Software Technologies Ltd. · Vendor: checkpoint

Last updated 2026-10-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-07-22Exploited Added to the CISA Known Exploited Vulnerabilities list
2026-07-22 14:17 UTCPublished CVE record published
2026-07-25Deadline CISA due date for US federal agencies to patch
2026-10-24 13:10 UTCUpdated Record last modified

checkpoint multi-domain security management UPGRADE

Affected: >= r77.30 and < r81.20 · r81.20 · r81.20 take_10 · r81.20 take_101 · r81.20 take_103 · r81.20 take_105 · r81.20 take_111 · r81.20 take_113

Fixed in: r81.20

Safe to downgrade to: a release before r77.30

1. Check installed version

apt-cache policy multi-domain-security-management || rpm -q multi-domain-security-management || multi-domain-security-management --version

2. UPGRADE to r81.20 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade multi-domain-security-management

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade multi-domain-security-management

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before r77.30 (Debian / Ubuntu)

apt-cache madison multi-domain-security-management sudo apt install multi-domain-security-management=<VERSION_BEFORE_r77.30> sudo apt-mark hold multi-domain-security-management

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list multi-domain-security-management sudo dnf downgrade multi-domain-security-management-<VERSION_BEFORE_r77.30> sudo dnf versionlock add multi-domain-security-management

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

checkpoint quantum security management UPGRADE

Affected: >= r77.30 and < r81.20 · r81.20 · r81.20 take_10 · r81.20 take_101 · r81.20 take_103 · r81.20 take_105 · r81.20 take_111 · r81.20 take_113

Fixed in: r81.20

Safe to downgrade to: a release before r77.30

1. Check installed version

apt-cache policy quantum-security-management || rpm -q quantum-security-management || quantum-security-management --version

2. UPGRADE to r81.20 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade quantum-security-management

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade quantum-security-management

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before r77.30 (Debian / Ubuntu)

apt-cache madison quantum-security-management sudo apt install quantum-security-management=<VERSION_BEFORE_r77.30> sudo apt-mark hold quantum-security-management

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list quantum-security-management sudo dnf downgrade quantum-security-management-<VERSION_BEFORE_r77.30> sudo dnf versionlock add quantum-security-management

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Fedora 46 · gnome-shell-extension-tiling-assistant · FIXED · 56-1.fc46 · FEDORA-2026-ebf66a5321 · source

sudo dnf upgrade --advisory=FEDORA-2026-ebf66a5321

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: sfewer-r7/CVE-2026-16232 (11 stars)
GitHub PoC: HackSpeak/CVE-2026-16232 (3 stars)
GitHub PoC: WadesWeaponShed/Check-Point-Trusted-Access-Review (0 stars)
Metasploit: Check Point SmartConsole Authentication Bypass Run Script RCE
Nuclei scan template: Check Point Security Management Server - SmartConsole Authentication Bypass

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-16232?

multi-domain security management: upgrade to r81.20; quantum security management: upgrade to r81.20. Exact commands for each OS are on this page.

Is CVE-2026-16232 being exploited?

Yes. CVE-2026-16232 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2026-16232 affect?

CVE-2026-16232 affects multi-domain security management, quantum security management. Severity is critical (CVSS 9.8). An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful e

How urgent is CVE-2026-16232?

Priority 97/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Software pages

Check Point vulnerabilities

Related CVEs

CVE-2026-93616 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE Check Point Multiple Products Path Traversal Vulnerability

References

← Back to latest CVEs