CheckPoint authentication bypass bug exploited, added to CISA list

CheckPoint reported July 22 that a 9.3 authentication bypass vulnerability affecting its Security Management, Multi-Domain Management and Security Gateways was exploited in the wild.

The Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog and instructed federal agencies to patch by July 25.

In its advisory, CheckPoint said the bug — CVE-2026-16232 — involved the SmartConsole login with an application token. The vendor said the bug affected a handful of customers whose management environments were directly exposed to the internet without IP restrictions.

Douglas McKee, director of vulnerability intelligence at Rapid7, explained that in simplified terms, this vulnerability targets the system that tells the firewalls what to trust.

McKee said an unauthenticated attacker can obtain an application token, sign in through SmartConsole with full administrative privileges, and change security policies or configurations.

“With this, the attacker has control of the management plane, potentially affecting every gateway managed from it,” said McKee. “The risk is no longer theoretical, as Check Point has confirmed active exploitation.”

Linda Mayes, regional president at Courser, added that the repeated exploitation of Check Point vulnerabilities underscores a broader reality in today's threat landscape: attackers are relentlessly targeting security infrastructure because it sits at the center of trust and control within an organization.

“When threat actors compromise firewalls, VPNs, or other network perimeter devices, they can bypass traditional defenses and gain privileged access at scale, making these edge systems some of the highest-value targets in any environment,” said Mayes.

When a vulnerability is added to the KEV catalog, it should be treated as a top-priority security event because active exploitation has already been confirmed. Delaying patching increases the risk of unauthorized access, configuration changes, ransomware deployment, and broader network compromise.

Organizations should review logs, investigate indicators of compromise, validate security policies, and look for suspicious administrative activity that may have occurred prior to patching. MSPs should also reduce future risk by limiting internet exposure of management interfaces, enforcing MFA, and restricting administrative access to trusted sources."

Donald McFarlane, advisory board member at Xcape, Inc. said firewalls, VPNs, remote-access platforms, cellular modems, and other network-edge devices remain among the highest-value targets because compromising them can undermine the security of an entire enterprise.

McFarlane said their hardware, firmware, and software are also commercially available for adversaries to study, test, and weaponize against. Organizations should assume these internet-facing systems will face sustained scrutiny from sophisticated attackers increasingly aided by AI, said McFarlane. Enterprises should minimize administrative and control-plane exposure, follow vendor hardening guidance, segment networks, monitor continuously for anomalous activity, and patch high-risk vulnerabilities without delay.

“But patch management alone is not enough,” said McFarlane. “Organizations also need the operational ability to detect compromise when prevention fails, contain its effects, and respond at machine speed.”