EUVD-2026-47700
GHSA-m2xx-23gx-734v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach internet-exposed Management Server IP
-
DeliverySend crafted SmartConsole login request
-
ExploitObtain application login token without credentials
-
ExecutionAuthenticate as full administrator
-
ImpactModify security policies and configurations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Two concrete prerequisites apply: (1) network reachability to the Management Server IP - for remote exploitation the server must be reachable over the internet (or from the attacker's network position); and (2) a Trusted Clients configuration that does NOT restrict which client IPs may connect to management/SmartConsole services. The primary limiting factor is therefore the Trusted Clients setting: deployments that restrict Trusted Clients to specific admin IPs, or that keep the Management Server off the public internet, are not remotely exploitable via this path. No authentication and no user interaction are required (PR:N/UI:N), and attack complexity is low (AC:L), so where those two conditions are met exploitation is straightforward and automatable. Affected only Quantum Security Management and Multi-Domain Security Management at the versions listed; gateways themselves are not the vulnerable component. |
| Impact | This is a genuine priority, not a paper high. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes remote, low-complexity, unauthenticated, no-interaction compromise of a security-critical management server with total impact - corroborated by CISA SSVC scoring Technical Impact as 'total' and Automatable as 'yes'. It is on CISA KEV as actively exploited and public exploit code exists, which normally forces immediate patching. The one signal pulling the other way is exploitation reach: EPSS is only 1.07% (61st percentile) and Check Point states a 'very small number' of customers were affected, and CISA's SSVC 'Exploitation: none' field conflicts with the KEV listing and the vendor's own confirmation of exploitation - this discrepancy should be treated as an SSVC data-lag artifact, not evidence exploitation is absent. Net read: low-to-moderate volume, likely targeted exploitation of a maximally-impactful bug - verify your exposure rather than assume you are out of scope. |
| Exploit ScenarioDerived | An attacker who can reach an internet-exposed Management Server that has not restricted Trusted Clients sends crafted requests to the SmartConsole login endpoint and coaxes it into issuing a valid application login token without credentials. Using that token, they open an authenticated administrative session and alter firewall and security policy - for example loosening rules or opening access to internal networks. Public exploit code exists and CISA confirms the technique is being used in the wild, so this requires no novel research on the attacker's part. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Aug 02, 2026
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid application login token and log in with full administrative privileges to Quantum Security Management and Multi-Domain Security Management servers (CWE-287, CVSS 4.0 9.3). Once authenticated, the attacker can rewrite security policies and configurations across managed gateways. It is confirmed actively exploited (CISA KEV) with publicly available exploit code, though Check Point reports only a very small number of affected customers, and the EPSS score is a modest 1.07% (61st percentile), consistent with targeted rather than mass exploitation.
Earlier versions of this analysis (1)
Authentication bypass in the Check Point SmartConsole login process lets an unauthenticated remote attacker mint a valid application login token and log in with full administrative rights to Quantum Security Management and Multi-Domain Security Management servers (R77.30 through R82.10). Because the compromised account is a management administrator, the attacker can rewrite firewall security policies and management configurations across every managed gateway. This is confirmed actively exploited (CISA KEV), publicly available exploit code exists, and Check Point states a very small number of customers have been affected - consistent with targeted rather than mass exploitation.
RemediationAI
Apply the fixing Jumbo Hotfix Accumulator for your train as directed in Check Point advisory sk185169 (https://support.checkpoint.com/results/sk/sk185169): move R81.20 above Jumbo Hotfix Take 158, R82 above Take 118, and R82.10 above Take 36; the exact fixed Take beyond the last-vulnerable values above is not enumerated in the provided data, so pull the current recommended Take directly from sk185169 rather than assuming a number. Systems on the legacy trains (R81.10, R81, R80.30, R80.20, R80.10, R80, R77.30) should be upgraded to a supported, patched release. The most effective compensating control, and the one that maps directly to the stated exploitation prerequisite, is to restrict Trusted Clients on the Management Server so that only known administrator source IPs may connect to SmartConsole/management services - this removes the internet-reachable, unrestricted-client condition the exploit needs, at the cost of having to maintain an accurate admin IP allowlist. Additionally, remove the Management Server IP from direct internet exposure (place it behind VPN/jump host and block external access to management ports), and review recent policy/configuration changes and admin sessions for signs of unauthorized modification given confirmed active exploitation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw sits in the SmartConsole login flow of Check Point's centralized management plane - the Security Management Server (Quantum Security Management) and its multi-tenant variant (Multi-Domain Security Management), identified by CPEs cpe:2.3:a:checkpoint:quantum_security_management and cpe:2.3:a:checkpoint:multi-domain_security_management. These servers are the administrative brain of a Check Point deployment: administrators use the SmartConsole client to author and push firewall/security policy to managed gateways. The root-cause class is CWE-287 (Improper Authentication): the login process can be coerced into issuing an application login token to a party who never proved a valid identity, so the token - not credentials - becomes the authenticator, and the attacker inherits an authenticated administrative session. Because the token grants the same authority as a legitimate admin, this is an authentication bypass rather than a privilege-escalation-after-login issue.
Know when Checkpoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote, low-complexity, unauthenticated token forgery yields full admin control of the management server, so PR:N/UI:N with high C/I/A; scope unchanged as impact stays within the compromised server's authority.
Primary rating from Vendor (checkpoint).
CVSS VectorVendor: checkpoint
Lifecycle Timeline
6DescriptionCVE.org
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
Articles & Coverage 1
Executive ViewAI
Your organization's security management infrastructure has a critical vulnerability enabling attackers to bypass authentication and hijack full administrative control of Check Point systems (CVE-2026-16232). This threat is confirmed actively exploited (CISA KEV) with publicly available exploit code, allowing unauthenticated remote attackers to rewrite security policies and disable protections across your managed network gateways. Immediate containment measures are essential to prevent unauthorized security policy modifications and compliance violations.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) restrict SmartConsole network access to trusted administrator IP ranges and implement strict firewall rules, (2) deploy network segmentation isolating management servers from general network access, (3) enable full audit logging and real-time alerting on all login attempts and configuration changes, (4) regularly audit administrative user accounts and review access logs for anomalous activity or unauthorized tokens, (5) monitor Check Point Security Advisories and threat intelligence feeds for workarounds or patch availability. Escalate with Check Point support for vulnerability confirmation and patch timeline.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Checkpoint
View allGNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the inte
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to e
Remote code execution in Check Point Quantum Security Gateway arises from improper certificate trust validation during V
Authentication bypass in Check Point Quantum Security Gateway and Spark Firewalls allows unauthenticated remote attacker
Unauthenticated attackers who can reach the file-upload interface of Check Point Management Server can combine directory
An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. Rated med
Remote code execution in Check Point Quantum Security Gateway and Quantum Security Management stems from a heap-based bu
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overfl
The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data
Elevated-privilege container restoration in CRI-O 1.34 and later, including downstream Red Hat OpenShift Container Platf
Exploit-DB