The Firewall Manager Accepted an Application Token. Attackers Became Administrators.
An unauthenticated attacker could ask a Check Point management server for an application token, redeem it as a SmartConsole administrator and gain the authority to change the security policy enforced across managed firewalls. The vulnerability was exploited before a patch existed. A public proof of concept now turns the same trust failure into reproducible code.
Check Point disclosed CVE-2026-16232 on 22 July 2026 and said it had affected a handful of customers. The known cases shared a specific exposure: the management server was reachable from the internet and Trusted Clients had not been restricted by IP address. CISA added the vulnerability to its Known Exploited Vulnerabilities catalogue and required federal remediation by 25 July.
The token path trusted an attacker-supplied identity
The flaw is in the SmartConsole application-token login process used by Check Point Security Management Server and Multi-Domain Security Management Server. Rapid7’s public proof of concept connects to the management services, forges an application identity, obtains an application login token and exchanges it for a SmartConsole administrator ticket.
No user password is needed. Successful exploitation gives the attacker full administrative privileges in the management plane, including the ability to view administrators and modify security policies or configurations. That is not the same as direct operating-system root access, but it is control over the system that decides which traffic managed gateways allow, which VPN settings they use and which security policies they install.
Rapid7’s demonstration uses the SIC/CPMI service on TCP port 18190 and the CPM service on TCP port 19009. A patched target rejects the malicious application bind at the first step. The code is therefore both a practical exposure check and a public exploit primitive that lowers the effort required to test vulnerable systems.
The July bulletin contains three distinct vulnerabilities
CVE-2026-16232 is the only issue in the bulletin that Check Point marked as exploited. It affects Security Management and Multi-Domain Management releases R81.10, R81.20, R82 and R82.10, with older branches also affected. Rapid7 lists fixed Jumbo Hotfix levels as Take 36 or later for R82.10, Take 118 or later for R82, and Take 158 or later for R81.20. No fixed take was specified for the older branches it listed.
CVE-2026-62144 is a separate management authentication bypass and privilege-escalation vulnerability. An unauthenticated remote attacker may execute administrative commands on the Management Server and, in some cases, commands on managed Security Gateways. Check Point reported no known exploitation.
CVE-2026-62145 is a high-severity privilege-escalation flaw in the Gaia Portal. An attacker who already has read-only Gaia Portal access can execute commands with root privileges. It affects firewalls, Multi-Domain Management and Multi-Domain Log Server products. Check Point also reported no known exploitation of this issue.
The latest Jumbo Hotfix released on 22 July addresses the bulletin. Smart-1 Cloud customers were already protected, according to Check Point.
Exposure control reduced risk, but did not remove the vulnerable code
Check Point recommends restricting SmartConsole Trusted Clients to approved IP addresses or subnets, placing management access behind a firewall and confirming that implied rules for control connections are enabled. Those measures explain why the observed victim set was narrow. They are containment controls, not replacements for the hotfix.
The vendor published six IP addresses associated with observed exploitation. Administrators should search for those indicators, but an absence of matches does not establish that an exposed server was safe. Infrastructure can change, and a valid administrator session can be used through ordinary management functions.
What defenders should do now
- Apply the relevant July Jumbo Hotfix to every Security Management and Multi-Domain Management server.
- Remove direct internet exposure and restrict Trusted Clients to dedicated administrative networks.
- Confirm whether TCP ports 18190 and 19009 were reachable from untrusted networks before remediation.
- Review SmartConsole, API, application-token, administrator, policy-change and policy-install activity for unauthorised actions.
- Investigate the published IP indicators and any unexpected application identities or administrator tickets.
- Treat unexplained policy or administrator changes as a management-plane incident, not merely as a missing patch.
The important boundary is not the SmartConsole window. It is the authority behind it. Once an unauthenticated request can become a full administrator session, the firewall manager itself becomes the route around the firewalls it controls.
Sources: Check Point July security advisory and Check Point product announcement (22 July 2026 at 10:07), Rapid7 analysis and remediation matrix (23 July 2026; no publication time provided), Rapid7 proof-of-concept repository (public by 29 July 2026; repository page provides no publication time), Check Point IPS protection advisory (29 July 2026; no publication time provided), and CISA Known Exploited Vulnerabilities catalogue (entry added 22 July 2026; no publication time provided).
