Check Point warns of SmartConsole zero-day exploited in attacks

Israeli cybersecurity firm Check Point Software has addressed an actively exploited zero-day flaw in the company's SmartConsole graphical user interface (GUI) admin panel.

Tracked as CVE-2026-16232, this authentication bypass vulnerability allows unauthenticated attackers to obtain an application login token that can be used to authenticate with administrator privileges.

After gaining access to a vulnerable Security Management Server or Multi-Domain Security Management Server (MDS), attackers can change the security configuration and security policy.

Check Point added that successful exploitation requires no restrictions on Trusted Clients (GUI clients) and the Management Server IP to be exposed to remote access via the Internet.

"Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients," the company said in a Sunday advisory.

Check Point warns of SmartConsole zero-day exploited in attacks

Other newsrooms on this story

Related reading

Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access

New Check Point Zero-Day Vulnerability Exploited in the Wild

Check Point links VPN zero-day attacks to Qilin ransomware gang

Check Point VPN Flaw Exploited Since Early May

Check Point VPN Zero-Day Exploited in Qilin Ransomware Attacks

Critical Check Point VPN Flaw Exploited to Bypass Passwords in IKEv1 Setups