What Changed
Check Point has patched CVE-2026-16232, an authentication bypass in its SmartConsole management path that attackers exploited as a zero-day. A successful attack yields an application login token with administrator rights on the Security Management Server or Multi-Domain Server, which is effectively control of the firewall policy plane.
CISA added the flaw to the KEV catalog on July 22 with a remediation deadline of July 25 for federal civilian agencies.
Who Is Exposed
According to Check Point, exploitation requires two conditions: the management server’s Trusted Clients setting is unrestricted, and the management IP address is reachable from the internet. Environments that limit Trusted Clients to known administrator addresses and keep management interfaces off the internet are not exposed to this attack path, though they should still patch.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
What To Verify First
- Apply Check Point’s fixes to every Security Management Server and Multi-Domain Server.
- Restrict Trusted Clients to specific administrator hosts and remove internet exposure of management IPs.
- Search management audit logs for logins showing
Authentication method: application tokenthat do not match expected automation. - Check for connections from the indicator IPs Check Point published: 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99 and 139.28.37.250.
What Teams May Be Underestimating
An attacker with admin rights on a management server can change rules, add accounts or push policy to every gateway it manages. If logs show suspicious token logins, review recent policy installs and administrator changes, not just the server’s patch level.
The exposure conditions are configuration choices, which makes them worth auditing beyond this CVE. Knowing which management servers accept connections from any client, and which are reachable from the internet, shortens the response to the next management-plane flaw as well.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
- BleepingComputer: Check Point patches SmartConsole zero-day exploited in attacks
- CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (July 22, 2026)
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Thursday’s brief: Cisco email gateways under attack, then PAN-OS, Nextcloud and AhsayCBS
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
