A critical authentication bypass in SmartConsole that was actively exploited as a zero-day before patches were available. Tracked as CVE-2026-16232, the flaw affects Security Management Server and Multi-Domain Security Management Server (MDS) and can give an unauthenticated attacker full administrator access through the SmartConsole management interface.
On July 22, 2026, Check Point published a security advisory detailing the issue, while Rapid7 Labs confirmed exploitation in the wild and released a public proof-of-concept to help defenders validate exposure.
CVE-2026-16232 sits in the SmartConsole login path. An attacker with network reach to the Management Server can obtain an application login token, use it to authenticate through SmartConsole with full administrator privileges, and then change security policy or configuration.
Check Point Zero-Day PoC Released
Successful abuse depends on network access to the management plane and a Trusted Clients setup that does not tightly restrict GUI clients, a condition Rapid7 observed as default in testing.
Because the bug was already under attack at disclosure, organizations running exposed management servers face elevated risk until they patch and harden access.
According to Rapid7’s analysis, the root cause is a broken trust boundary in application authentication. A vulnerable server accepts an attacker-supplied Secure Internal Communication (SIC) distinguished name as the identity of a remote application instead of binding that identity to the authenticated remote peer certificate returned by the platform.
An attacker can learn the management server’s own SIC DN during unauthenticated bootstrap traffic, replay it in a forged application certificate bind, receive an application token, and then request a SmartConsole single sign-on ticket from the legacy management service. That ticket is redeemed over the newer CPM SOAP API, producing a full SmartConsole session with administrator rights.
SmartConsole management traffic spans two generations of services. The legacy FWM/CPMI service on TCP 18190 handles SIC-based trust and older FwSet-style exchanges, while the CPM/DLE stack on TCP 19009 exposes SOAP operations under /cpmws/ and relies on session headers after login.
The exploit chains both: it abuses FWM/CPMI to claim an application identity and mint a token, then uses that session to generate and redeem a SmartConsole SSO ticket.
Once redeemed, the attacker holds session identifiers that support privileged operations, including reading server details and enumerating administrator accounts. Audit logs may show “Authentication method: application token,” which defenders can treat as a useful indicator of compromise.
Rapid7 reproduced the issue on affected R81.20 and R82.10 builds and published a PoC script on GitHub that checks whether a target is vulnerable or patched.
Vendor fixes block the attack path by ensuring remote application authentication uses the certificate-bound peer DN rather than an untrusted caller-supplied name, and by rejecting mismatches or missing SIC identities. On patched systems, the forged bind fails, and the PoC reports the host as not vulnerable.
Organizations should apply Check Point’s recommended Jumbo Hotfix updates immediately, restrict management-plane access to trusted networks and clients, and review audit logs for suspicious application-token authentications.
