[KEV] CVE-2026-16232 -- CVSS 0.0 Vulnerability Briefing

[KEV] CVE-2026-16232 | CVSS 0.0 (Low) | Exploit: Operational

What Is It

CVE-2026-16232 is an improper authentication vulnerability in Check Point SmartConsole that can allow an unauthenticated remote attacker to obtain a SmartConsole application login token.

Technical Detail

The flaw is an authentication bypass affecting the SmartConsole login-token handling process. An unauthenticated remote attacker may be able to request or obtain a valid application login token and use it to authenticate with full administrative privileges. Successful exploitation could provide administrative access to the affected Check Point management environment without valid credentials.

Exploitation Status

Exploit maturity is assessed as Operational, meaning exploitation is sufficiently developed for practical use by threat actors. CISA has confirmed active exploitation in the wild. This vulnerability was added to the CISA Known Exploited Vulnerabilities Catalog on July 22, 2026.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Prioritize applying Check Point security updates or vendor-provided mitigations for SmartConsole immediately. Federal civilian executive branch agencies must patch by August 12, 2026, or apply mitigations in accordance with CISA Binding Operational Directive 22-01. Until remediation is complete, restrict SmartConsole access to trusted administrative networks, limit exposure of management interfaces to the internet, and review SmartConsole and management-server authentication logs for unexpected login tokens, new administrative sessions, or administrative activity from unrecognized source addresses. No specific workaround or detection signature has been confirmed in the available vulnerability data.