Check Point Patches SmartConsole Flaw That Granted Administrator Rights

Check Point has released a package of security updates for its Security Management and Multi-Domain Security Management (MDSM) products. Among the issues addressed is a critical vulnerability that, according to the vendor, is already being exploited in real-world attacks.

Authentication bypass in SmartConsole

The flaw has been assigned the identifier CVE-2026-16232 and a CVSS score of 9.3. It is an authentication bypass in the SmartConsole login process: an unauthorized remote attacker can obtain an application login token and use it to authenticate with full administrator privileges. From there, the attacker can alter security policies and settings.

Exploitation requires network access to the IP address of the management server and a configuration in which the list of trusted clients (Trusted Clients) is not restricted. As Check Point VP of Research Lotem Finkelstein stressed, the risk arises only in a very specific scenario — when the management server is directly exposed to the internet without IP restrictions. According to him, the company is aware of a small number of affected customers and has already notified them; the nature of the attacks and when they were detected have not been disclosed.

The vendor has published indicators of compromise — a set of six IP addresses associated with the malicious activity.

Two more vulnerabilities

The patches also close two other issues. CVE-2026-62144 (CVSS 9.3) is an authentication bypass that allows an unauthorized attacker to run administrative commands on the management server, including run-script and exec-command on the security gateway; the exploitation conditions are the same as for the first flaw. CVE-2026-62145 (CVSS 7.5) is an improper privilege management issue in the Gaia portal, in which an authenticated read-only user can execute commands with root privileges.

All three issues affect a wide range of versions — from R77.30 to R82.10.

What to do

Customers are advised to install the Jumbo hotfix from July 22, restrict the list of trusted GUI clients to trusted IP addresses and subnets, secure access to firewall management and, in general, limit access to trusted addresses.

The U.S. agency CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal civilian agencies to remediate the issue by July 25, 2026.

Source: The Hacker News