Skip to content
OriginalSign in
Image: SecurityOnline

SecurityOnlineDo Son

Check Point SmartConsole Authentication Bypass CVE-2026-16232 Exploited as Zero-Day, PoC and Details Public

Part of the CVE-2026-16232 story · since 22 Jul

Quiet for 13 weekslast report 29 Jul12 articles5 outlets
22 Jul · SecurityOnline first11 Sep28 Sep15 OctNowThis article12th of 12
  • Wed 22 Jul, 19:08 UTC. SecurityOnline, first report. Check Point SmartConsole flaw CVE-2026-16232 under active attack. Cites a CVE in CISA KEV.
  • Wed 22 Jul, 20:20 UTC. CISA, its first report on the story. CISA Flags Active Exploitation of Check Point SmartConsole Flaw. Cites a CVE in CISA KEV.
  • Wed 22 Jul, 22:02 UTC. CISA. CISA flags Check Point SmartConsole flaw in latest KEV update. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 04:06 UTC. SecurityOnline. GitHub Actions Abused to Steal Credentials from PHP Packages. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 04:07 UTC. SecurityOnline. Two Active BIND Exploits Highlighted as Nine Flaws Patched. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 09:09 UTC. SecurityWeek, its first report on the story. Check Point Zero Day CVE-2026-16232 Exploited for Auth Bypass. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 09:45 UTC. Security Affairs, its first report on the story. Check Point fixes critical SmartConsole auth bypass exploited now. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 13:10 UTC. Rapid7, its first report on the story. CVE-2026-16232 flaw lets hackers access Check Point admin. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 21:01 UTC. Security Affairs. U.S. CISA adds Microsoft SharePoint and Check Point SmartConsole flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Fri 24 Jul, 03:10 UTC. SecurityOnline. Heap overflow bug in Knot Resolver lets attackers run code. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 02:21 UTC. SecurityOnline. UK firms must patch now as CISA flags six active exploits. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 08:13 UTC. SecurityOnline. Check Point SmartConsole Authentication Bypass CVE-2026-16232 Exploited as Zero-Day, PoC and Details Public. Cites a CVE in CISA KEV. This article, 12th of 12.

A critical vulnerability, CVE-2026-16232, allows unauthenticated attackers to bypass authentication in Check Point's SmartConsole, gaining full administrator access. The flaw, which has a CVSS score of 9.1, affects several versions of the Check Point Quantum Security Management product and is actively exploited in the wild. Attackers exploit a broken trust boundary in the login process, leading to unauthorized admin access.

Check Point has released patches for certain versions, and users are advised to restrict access to management servers and monitor audit logs for suspicious activity.

How the story developed

All 12 articles
Quiet for 13 weekslast report 29 Jul12 articles5 outlets

12 articles from 5 outlets since 22 Jul. Quiet since 29 Jul. This was the 12th report, 7 days after the first.

Now22 Jul24252627282930First reportSecurityOnline · 22 Jul, 19:08This article12th of 12 · day 7
  • Wed 22 Jul, 19:08 UTC. SecurityOnline, first report. Check Point SmartConsole flaw CVE-2026-16232 under active attack. Cites a CVE in CISA KEV.
  • Wed 22 Jul, 20:20 UTC. CISA, its first report on the story. CISA Flags Active Exploitation of Check Point SmartConsole Flaw. Cites a CVE in CISA KEV.
  • Wed 22 Jul, 22:02 UTC. CISA. CISA flags Check Point SmartConsole flaw in latest KEV update. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 04:06 UTC. SecurityOnline. GitHub Actions Abused to Steal Credentials from PHP Packages. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 04:07 UTC. SecurityOnline. Two Active BIND Exploits Highlighted as Nine Flaws Patched. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 09:09 UTC. SecurityWeek, its first report on the story. Check Point Zero Day CVE-2026-16232 Exploited for Auth Bypass. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 09:45 UTC. Security Affairs, its first report on the story. Check Point fixes critical SmartConsole auth bypass exploited now. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 13:10 UTC. Rapid7, its first report on the story. CVE-2026-16232 flaw lets hackers access Check Point admin. Cites a CVE in CISA KEV.
  • Thu 23 Jul, 21:01 UTC. Security Affairs. U.S. CISA adds Microsoft SharePoint and Check Point SmartConsole flaws to its Known Exploited Vulnerabilities catalog. Cites a CVE in CISA KEV.
  • Fri 24 Jul, 03:10 UTC. SecurityOnline. Heap overflow bug in Knot Resolver lets attackers run code. Cites a CVE in CISA KEV.
  • Mon 27 Jul, 02:21 UTC. SecurityOnline. UK firms must patch now as CISA flags six active exploits. Cites a CVE in CISA KEV.
  • Wed 29 Jul, 08:13 UTC. SecurityOnline. Check Point SmartConsole Authentication Bypass CVE-2026-16232 Exploited as Zero-Day, PoC and Details Public. Cites a CVE in CISA KEV. This article, 12th of 12.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 12 articles as a list
  1. Wed 22 JulDay 03
    1. Check Point SmartConsole flaw CVE-2026-16232 under active attack19:08 · SecurityOnline · First report · Known exploited CVE
    2. CISA Flags Active Exploitation of Check Point SmartConsole Flaw20:20 · CISA · official · CISA alert · Known exploited CVE
    3. CISA flags Check Point SmartConsole flaw in latest KEV update22:02 · CISA · official · Known exploited CVE
  2. Thu 23 JulDay 16
    1. GitHub Actions Abused to Steal Credentials from PHP Packages04:06 · SecurityOnline · Known exploited CVE
    2. Two Active BIND Exploits Highlighted as Nine Flaws Patched04:07 · SecurityOnline · Known exploited CVE
    3. Check Point Zero Day CVE-2026-16232 Exploited for Auth Bypass09:09 · SecurityWeek · Known exploited CVE
    Show 3 more from 23 Jul
    1. Check Point fixes critical SmartConsole auth bypass exploited now09:45 · Security Affairs · Known exploited CVE
    2. CVE-2026-16232 flaw lets hackers access Check Point admin13:10 · Rapid7 · Known exploited CVE
    3. U.S. CISA adds Microsoft SharePoint and Check Point SmartConsole flaws to its Known Exploited Vulnerabilities catalog21:01 · Security Affairs · Known exploited CVE
  3. Fri 24 JulDay 21
    1. Heap overflow bug in Knot Resolver lets attackers run code03:10 · SecurityOnline · Known exploited CVE

  4. Quiet for 3 days

    Mon 27 JulDay 51
    1. UK firms must patch now as CISA flags six active exploits02:21 · SecurityOnline · Picked up again · Known exploited CVE

  5. Quiet for 2 days

    Wed 29 JulDay 71
    1. Check Point SmartConsole Authentication Bypass CVE-2026-16232 Exploited as Zero-Day, PoC and Details Public08:13 · SecurityOnline · Picked up again · Known exploited CVE · This article, 12th of 12

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in