Check Point has released security updates to address multiple vulnerabilities impacting Security Management and Multi-Domain Management (MDSM) products, including a critical flaw that has come under active exploitation in the wild.
Actively Exploited Authentication Bypass
The security flaw, tracked as CVE-2026-16232 (CVSS score: 9.3), is an authentication bypass affecting the Check Point SmartConsole login process that allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.
“Successful exploitation allows the attacker to modify security policies and security configurations,” according to a description of the flaw in CVE.org. “Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients.”
Lotem Finkelstein, vice president of research at Check Point, said the company is aware of a small number of customers being targeted by this flaw and has already notified them. The company did not disclose the nature of the attacks or when they were discovered.
“This only affects a very specific configuration — when Management is exposed directly to the internet without IP restrictions,” Finkelstein added.
Check Point has shared the following indicators of compromise (IoCs) associated with the activity:
- 151.241.99[.]207
- 151.241.99[.]233
- 158.62.198[.]182
- 192.142.10[.]99
- 139.28.37[.]250
- 194.213.18[.]137
Additional Vulnerabilities Patched
Patches have also been released for two other flaws:
- CVE-2026-62144 (CVSS score: 9.3) — An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management that allows an unauthenticated remote attacker to execute administrative commands on the Management Server, including run-script and exec-command on Security Gateway.
- CVE-2026-62145 (CVSS score: 7.5) — An improper privilege management vulnerability in Check Point Gaia Portal that allows an authenticated attacker with read-only Gaia Portal privileges to execute commands with root privileges.
Like CVE-2026-16232, successful exploitation of CVE-2026-62144 requires management access without Firewall protection or no restrictions on Trusted Clients (GUI clients). All three issues affect the following versions:
- R77.30
- R80
- R80.10
- R80.20
- R80.30
- R81
- R81.10
- R81.20
- R82
- R82.10
Recommended Mitigations
Customers are recommended to apply the July 22 Jumbo hotfix, limit Trusted Clients (GUI clients) to trusted IP addresses and subnets, secure Management access with a Firewall, and restrict access to trusted IP addresses only.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-16232 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the necessary fixes by July 25, 2026.
