A critical authentication bypass vulnerability in Check Point’s SmartConsole management platform allows unauthenticated attackers to seize full administrator control over Security Management Servers.
Tracked as CVE-2026-16232, the flaw was disclosed by Check Point on July 22, 2026, and affects both Security Management Server and Multi-Domain Security Management Server (MDS) deployments.
Rapid7 confirmed the vulnerability is being actively exploited in the wild as a zero-day. The vulnerability stems from a flaw in how SmartConsole’s authentication path validates identity claims.
Check Point SmartConsole Zero-Day
Normally, the system should bind an application’s identity to the authenticated peer certificate returned by getCertificateDnName(). Instead, vulnerable versions accept an attacker-supplied Secure Internal Communication (SIC) distinguished name (DN) as a substitute for that authenticated identity.
Because a remote attacker can read the management server’s own SIC DN during the unauthenticated SIC bootstrap phase, they can simply replay that DN in a forged certificate bind request without ever presenting a valid client certificate.
This tricks the server into treating the attacker as a legitimate application. Exploitation chains together two generations of Check Point’s management architecture:
- The legacy FWM/CPMI service (TCP 18190), which handles SIC-based trust
- The modern CPM/DLE service (TCP 19009), exposing SOAP APIs under
/cpmws/
An attacker first forges an application bind on the FWM/CPMI service, obtaining an application login token. That token is then used to issue a gen-sso-token request, which FWM’s authorization logic approves under a special case for system_admin-level clients requesting SmartConsole tickets bypassing the standard permission mask check entirely.
The resulting SSO ticket is redeemed via a SOAP loginNew call to the CPM service, yielding a fully authenticated SmartConsole session complete with clientSessionId and sid values granting the attacker the same privileges as a legitimate administrator, including policy and configuration changes.
Rapid7 noted that exploitation requires only network access to the Management Server and a default Trusted Clients configuration that doesn’t restrict GUI clients, a setting the firm found to be default in testing.
Check Point’s fix, present in R81.20 Jumbo Hotfix Take 158, restricts DN-claim trust to loopback traffic only (CN=siclocal).
For remote connections, the server now exclusively uses the authenticated peer certificate DN, rejecting any mismatch between a supplied DN and the certificate’s actual identity. An additional check blocks logins where no authenticated SIC identity exists at all.
Organizations can identify potential exploitation attempts by checking audit logs for the string “Authentication method: application token”, which Rapid7 identified as a reliable indicator of compromise tied to the ticket redemption step.
Rapid7 has released a proof-of-concept validation script to help administrators test exposure, and confirmed the vendor patch successfully blocks the exploit. Organizations running affected R81.20 and R82.10 versions should apply Check Point’s patches immediately, given confirmed in-the-wild exploitation.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
