CVE-2026-16232

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:checkpoint:multi-domain_security_management:*:*:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:-:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_10:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_101:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_103:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_105:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_111:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_113:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_115:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_118:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_119:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_120:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_122:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_126:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_127:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_14:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_141:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_146:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_24:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_26:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_38:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_41:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_43:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_45:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_53:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_54:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_65:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_70:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_76:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_79:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_8:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_84:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_89:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_90:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_92:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_96:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_98:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r81.20:take_99:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:-:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_10:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_103:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_107:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_12:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_14:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_18:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_19:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_25:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_33:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_34:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_36:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_39:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_41:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_43:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_44:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_60:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_73:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82:take_91:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:-:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:take_19:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:take_24:*:*:*:*:*:*
cpe:2.3:a:checkpoint:multi-domain_security_management:r82.10:take_6:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:checkpoint:quantum_security_management:*:*:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:-:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_10:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_101:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_103:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_105:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_111:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_113:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_115:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_118:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_119:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_120:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_122:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_126:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_127:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_14:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_141:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_146:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_24:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_26:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_38:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_41:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_43:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_45:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_53:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_54:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_65:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_70:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_76:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_79:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_8:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_84:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_89:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_90:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_92:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_96:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_98:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r81.20:take_99:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:-:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_10:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_103:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_107:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_12:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_14:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_18:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_19:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_25:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_33:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_34:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_36:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_39:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_41:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_43:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_44:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_60:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_73:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82:take_91:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82.10:-:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82.10:take_19:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82.10:take_24:*:*:*:*:*:*
cpe:2.3:a:checkpoint:quantum_security_management:r82.10:take_6:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de omisión de autenticación en el proceso de inicio de sesión de Check Point SmartConsole permite a un atacante remoto no autenticado obtener un token de inicio de sesión de aplicación y usarlo para autenticarse con privilegios administrativos completos. La explotación exitosa permite al atacante modificar políticas de seguridad y configuraciones de seguridad. La explotación remota requiere acceso a internet a la dirección IP del servidor de gestión y una configuración que no restrinja los Clientes de Confianza. Check Point es consciente de que esta vulnerabilidad está siendo explotada y ha afectado a un número muy pequeño de clientes.

Information

Published : 2026-07-22 14:17

Updated : 2026-10-24 13:10


NVD link : CVE-2026-16232

Mitre link : CVE-2026-16232

CVE.ORG link : CVE-2026-16232


JSON object : View

Products Affected

checkpoint

  • multi-domain_security_management
  • quantum_security_management
CWE
CWE-287

Improper Authentication