CVE-2026-16232

CRITICALCVSS 9.8Known Exploited

CISA Known Exploited Vulnerability

https://support.checkpoint.com/results/sk/sk185169/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-16232

Remediation deadline: July 25, 2026

Description

Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.

Timeline

Published:July 22nd, 2026 2:17 PM

Last modified:August 10th, 2026 7:59 PM

Added to KEV:July 22nd, 2026

CVSS Scoring

CVSS v3: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Software

From NVD CPE configuration data

Vendors

checkpoint

Products

multi-domain_security_managementquantum_security_management

Weaknesses (CWE)

CWE-287

References & Reports

Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute