CVE-2026-16232

Опубликовано: 22 июл. 2026

Источник: nvd

CVSS3: 9.1

EPSS Средний

Описание

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.

Ссылки

https://support.checkpoint.com/results/sk/sk185169
Mitigation
Patch
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-16232
US Government Resource

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:checkpoint:multi-domain_security_management:*:*:*:*:*:*:*:*

Версия от r77.30 (включая) до r81.20 (исключая)

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:-:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_10:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_101:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_103:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_105:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_111:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_113:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_115:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_118:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_119:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_120:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_122:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_126:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_127:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_14:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_141:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_146:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_24:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_26:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_38:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_41:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_43:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_45:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_53:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_54:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_65:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_70:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_76:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_79:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_8:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_84:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_89:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_90:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_92:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_96:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_98:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_99:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:-:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_10:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_103:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_107:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_12:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_14:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_18:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_19:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_25:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_33:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_34:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_36:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_39:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_41:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_43:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_44:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_60:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_73:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_91:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:-:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:take_19:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:take_24:*:*:*:*:*:*

cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:take_6:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:a:checkpoint:quantum_security_management:*:*:*:*:*:*:*:*

Версия от r77.30 (включая) до r81.20 (исключая)

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:-:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_10:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_101:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_103:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_105:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_111:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_113:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_115:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_118:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_119:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_120:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_122:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_126:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_127:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_14:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_141:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_146:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_24:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_26:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_38:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_41:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_43:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_45:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_53:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_54:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_65:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_70:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_76:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_79:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_8:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_84:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_89:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_90:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_92:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_96:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_98:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_99:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:-:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_10:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_103:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_107:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_12:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_14:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_18:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_19:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_25:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_33:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_34:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_36:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_39:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_41:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_43:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_44:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_60:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_73:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82:take_91:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82.10:-:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82.10:take_19:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82.10:take_24:*:*:*:*:*:*

cpe:2.3:a:checkpoint:quantum_security_management:r82.10:take_6:*:*:*:*:*:*

EPSS

Процентиль: 96%

0.12685

Средний

9.1 Critical

CVSS3

Дефекты

CWE-287

Связанные уязвимости

GHSA-m2xx-23gx-734v

CVSS3: 9.1

github

8 дней назад

BDU:2026-10493

CVSS3: 9.1

fstec

9 дней назад

Уязвимость приложения для управления системами безопасности Check Point SmartConsole, связанная с недостатками процедуры аутентификации, позволяющая нарушителю обойти существующие механизмы безопасности и выполнить произвольный код

EPSS

Процентиль: 96%

0.12685

Средний

9.1 Critical

CVSS3

Дефекты

CWE-287