CVE-2026-16232: Public PoC for Check Point SmartConsole Auth Bypass – Patch Now?
Just saw the update from Rapid7 regarding CVE-2026-16232. The PoC for the authentication bypass in Check Point SmartConsole is officially public.
For those catching up, this targets the Check Point Security Management Server and Multi-Domain Security Management (MDS). It's a critical auth bypass (CVSS 9.3) that allows unauthenticated attackers to take over the management plane. Since active exploitation was spotted before the PoC dropped, we should assume the honeymoon period is over.
The flaw allows skipping the login process entirely. If you're managing these gateways, check your logs for successful SmartConsole connections from unexpected IPs immediately. Note that because it bypasses the standard auth flow, you won't see failed password attempts preceding the access.
If you need to grep your management logs for SmartConsole connections, you might use something like this:
grep -i "smartconsole" /var/log/opt/CPsuite-R81.X/fw1/mtlog*.elg | grep "login"
Given that this affects the management server, the blast radius is total network compromise. Are we seeing widespread scanning for this yet, or is the noise still low? How painful was the patch rollout for everyone else?
Patch rollout was smoother than expected on our MDS, but the downtime for the Security Management Server was nerve-wracking. We applied TOT_JUMBO_HF hotfix earlier today.
On the detection side, we've setup a correlation rule to alert on any fwm process connections from IPs not in our known admin subnets. Since SmartConsole communicates via specific ports (usually TCP 19009 or 443 depending on version), monitoring for netstat anomalies there is a good interim control.
I'm currently pentesting a client environment and confirmed this works shockingly well. It gives full administrative rights to the management server immediately. The scariest part? It doesn't trigger the standard "Lockout" alerts because the user never technically 'fails' a login.
If you can't patch instantly, block access to the SmartConsole port (TCP 18190 / 19009) from the internet immediately and enforce VPN connectivity strictly for management access.
We saw a spike in scanning for port 18190 about 2 hours ago across our honeypots. It looks like script kiddies are incorporating the PoC into mass scanners already.
If you are using Check Point's Central Management, make sure you check the 'Connected Clients' view. Look for sessions with a version of SmartConsole that doesn't match your internal standards or coming from regions where you don't have staff.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access