Attackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232)
Attackers are exploiting a critical authentication bypass vulnerability (CVE-2026-16232) that affects Check Point Security Management and Multi-Domain Security Management, the management servers that push policy to Check Point security gateways (i.e., firewalls).
“An unauthenticated attacker can obtain an application login token and use it to login via SmartConsole with full admin privileges and apply changes to the security policy and security configuration,” the company said.
The vulnerability is being exploited, they confirmed, and a “handful” of customers have been affected (and notified).
Remediation, mitigation, investigation
CVE-2026-16232 affects a number of supported and end-of-service versions of Check Point Security Management and Multi-Domain Security Management. Hotfixes are available for the supported versions: R81.20, R82, and R82.10
“Successful remote exploit requires internet access to the Management Server IP address and no restrictions on Trusted Clients (GUI clients),” Check Point noted.
Thus, if customers can’t implement one of the provided “jumbo hotfixes” immediately, they can mitigate the risk of exploitation by limiting Trusted Clients to trusted IP addresses/subnets, and by protecting Management access with Firewall and restricting access to trusted IP addresses.
Check Point also shared a list of IP addresses associated with the attacks, and instructed customers on how to use this information to verify whether they’ve been affected.
“The Management Server is not simply another administrative system. It controls critical security functions such as: security policies, administrator permissions, managed gateways, VPN configurations, Threat Prevention settings, policy installation, logging and monitoring,” a MVP contributor to Check Point’s CheckMates community forum noted.
“A vulnerability affecting the Management Plane can undermine the trust model of the entire security architecture. Even organizations whose Management Servers are not directly exposed to the Internet should not postpone remediation. Network restrictions reduce exposure, but they do not remove the vulnerable code.”
The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-16232 to its Known Exploited Vulnerabilities catalog, and requires civilian US federal agencies to address it by July 25 and investigate whether they’ve been hit by attackers.
Additional flaws fixed
The jumbo hotfixes released by Check Point also fix:
- CVE-2026-62144, a similarly critical vulnerability that allows unauthenticated attackers to execute administrative commands on the Management Server and then allows them to execute commands on managed security gateways
- CVE-2026-62145, a vulnerability in Gaia Portal – the web-based management interface for Check Point’s Linux-based operating system that runs on management servers and security gateways – that allows an authenticated attacker with read-only access to run commands as root.
These are not known to be actively exploited, and the latter also affects Check Point firewalls (except Check Point Spark Gateways), not just the management servers.
UPDATE (July 30, 2026, 11:25 a.m. ET):
Rapid7 released a root-cause analysis of CVE-2026-16232 and a proof-of-concept (PoC) exploit script for checking whether a target is vulnerable or has been patched.
Xavier Bellekens, CEO of cyber deception and threat intelligence firm Lupovis, told Help Net Security that their honeypots flagged activity consistent with automated exploitation of CVE-2026-16232 or CVE-2026-62144 on April 29, 2026.
“An adversary attempted to authenticate and immediately enumerate the managed gateway environment in a sequence. After a review of the different elements, we observed pre-disclosure probing of the Check Point Management API (/web_api/login, show-gateways-and-servers) consistent with the management-plane authentication-bypass cluster of CVE-2026-16232 and CVE-2026-62144,” he told us.
“We linked the activity to these vulnerabilities because the requests targeted the affected Check Point batch API endpoints, and the request structure and payload matched the published exploitation path remote code execution issues. We classify these as exploitation attempts rather than general scanning because the actors were sending requests designed to exercise the vulnerable functionality, not simply checking whether the endpoints existed.”
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!