CVE-2026-16232: Active Exploitation Requires Immediate Management Plane Remediation
On July 22, 2026, Check Point published an important security update addressing multiple vulnerabilities affecting Security Management, Multi-Domain Management, Security Gateways, and related components.
The most urgent issue is CVE-2026-16232, an authentication bypass involving SmartConsole login with an application token.
Check Point confirmed that this vulnerability has been observed in the wild, affecting a handful of customers whose Management environments were directly exposed to the Internet without IP restrictions.
July 2026 Security Update
| CVE |
Description |
CVSS |
Affected Products |
Active Exploitation |
| CVE-2026-16232 |
Authentication bypass with SmartConsole login using an application token |
9.3 |
Security Management and Multi-Domain Management |
Yes |
| CVE-2026-62144 |
Management authentication bypass and privilege escalation |
9.3 |
Security Management and Multi-Domain Management |
No exploitation reported |
| CVE-2026-62145 |
Local privilege escalation in Gaia Portal |
7.5 |
Firewall, Multi-Domain Management, and Multi-Domain Log Server |
No exploitation reported |
Affected versions include:
Why This Is Critical
The Management Server is not simply another administrative system.
It controls critical security functions such as:
A vulnerability affecting the Management Plane can undermine the trust model of the entire security architecture.
Even organizations whose Management Servers are not directly exposed to the Internet should not postpone remediation. Network restrictions reduce exposure, but they do not remove the vulnerable code.
Immediate Actions
Check Point recommends that customers:
-
Install the latest Jumbo Hotfix released on July 22, 2026.
-
Restrict SmartConsole Trusted Clients to approved IP addresses or subnets.
-
Protect Management access with a firewall.
-
Avoid direct Internet exposure of Security Management systems.
-
Verify that implied rules for control connections are enabled and correctly restricted.
-
Review administrator, SmartConsole, API, application-token, policy-change, and policy-install activity.
-
Search relevant logs for the published indicators of compromise.
Published IP indicators:
151.241.99[.]207
151.241.99[.]233
158.62.198[.]182
192.142.10[.]99
139.28.37[.]250
194.213.18[.]137
An IoC match should trigger investigation, but the absence of these addresses does not prove that an environment was not affected.
Mitigation Is Not Remediation
Restricting Trusted Clients and protecting Management access are essential containment measures.
However, they must not replace installation of the security update.
The correct response sequence is:
Reduce exposure
↓
Install the Jumbo Hotfix
↓
Review for indicators of compromise
↓
Validate Management access and operations
↓
Continue monitoring
After installation, organizations should confirm:
-
The correct Jumbo Hotfix Take is installed
-
SmartConsole access is limited to authorized sources
-
Management High Availability is healthy, where applicable
-
Policy installation works correctly
-
Administrative accounts and application tokens are valid
-
Temporary access rules have been removed
-
Logging and monitoring remain operational
SecureKnowledge References
-
sk185169 — CVE-2026-16232
-
sk185152 — CVE-2026-62144
-
sk185153 — CVE-2026-62145
Official Advisory
https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-check-...
The key lesson is clear:
Management infrastructure must be treated as Tier-0 security infrastructure.
Do not expose it directly to the Internet, limit administrative access, install the security update, and validate the environment after remediation.
How quickly can your organization assess exposure, deploy an emergency Jumbo Hotfix, and confirm that the Management Plane remains trusted?
