SmartConsole zero-day patched after active use
Check Point patched CVE-2026-16232. Attackers used the SmartConsole authentication bypass as a zero-day. A successful attack yields an application login token with administrator rights on the Security Management Server or Multi-Domain Server. That is control of the firewall policy plane.
CISA put it on KEV on July 22. Federal civilian agencies had until July 25.
Trusted Clients open plus internet-reachable management
Check Point says exploitation needs two things. Trusted Clients must be unrestricted. The management IP must be reachable from the internet. Sites that limit Trusted Clients to known administrator addresses and keep management off the internet are not on this attack path. Patch anyway.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Patch, lock Trusted Clients, hunt token logins
- Apply Check Point’s fixes to every Security Management Server and Multi-Domain Server.
- Restrict Trusted Clients to specific administrator hosts and remove internet exposure of management IPs.
- Search management audit logs for logins showing
Authentication method: application tokenthat do not match expected automation. - Check for connections from the indicator IPs Check Point published: 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99 and 139.28.37.250.
Admin on management means policy for every gateway
Admin rights on a management server mean changed rules, new accounts, or policy pushed to every gateway it manages. Suspicious token logins? Review recent policy installs and administrator changes. Do not stop at the server’s patch level.
These exposure conditions are configuration choices. Audit them beyond this CVE. Know which management servers accept connections from any client. Know which are reachable from the internet. That shortens the response to the next management-plane flaw too.
Sources
- BleepingComputer: Check Point patches SmartConsole zero-day exploited in attacks
- CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (July 22, 2026)
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Wednesday’s brief: Barracuda gateways go from no login to root, then Chrome 157, cPGuard and WordPress
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
