CVE-2026-16232: Check Point SmartConsole Auth Bypass Exploited ITW — CISA KEV Deadline Today

Check Point patched CVE-2026-16232 (CVSS 9.3), a critical authentication bypass in SmartConsole that lets unauthenticated remote attackers obtain an admin login token and gain full control over Security Management and Multi-Domain Management servers, including the ability to rewrite firewall policy. Exploitation was confirmed in the wild before disclosure, with the Qilin ransomware group linked to recent targeting of Check Point appliances. CISA added the flaw to its KEV catalog and set today — July 25 — as the mandatory federal patch deadline under BOD 26-04; all organizations with internet-exposed management servers should treat this as emergency priority.

CISA added the flaw to its KEV catalog and set today — July 25 — as the mandatory federal patch deadline under BOD 26-04; all organizations with internet-exposed management servers should treat this as emergency priority.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.