Attackers exploit critical Check Point flaw to take over firewall management (CVE-2026-16232)

Attackers are exploiting a critical authentication bypass vulnerability (CVE-2026-16232) that affects Check Point Security Management and Multi-Domain Security Management, the management servers that push policy to Check Point security gateways (i.e., firewalls).

“An unauthenticated attacker can obtain an application login token and use it to login via SmartConsole with full admin privileges and apply changes to the security policy and security configuration,” the company said.

The vulnerability is being exploited, they confirmed, and a “handful” of customers have been affected (and notified).

Remediation, mitigation, investigation

CVE-2026-16232 affects a number of supported and end-of-service versions of Check Point Security Management and Multi-Domain Security Management. Hotfixes are available for the supported versions: R81.20, R82, and R82.10

“Successful remote exploit requires internet access to the Management Server IP address and no restrictions on Trusted Clients (GUI clients),” Check Point noted.

Thus, if customers can’t implement one of the provided “jumbo hotfixes” immediately, they can mitigate the risk of exploitation by limiting Trusted Clients to trusted IP addresses/subnets, and by protecting Management access with Firewall and restricting access to trusted IP addresses.

Check Point also shared a list of IP addresses associated with the attacks, and instructed customers on how to use this information to verify whether they’ve been affected.

“The Management Server is not simply another administrative system. It controls critical security functions such as: security policies, administrator permissions, managed gateways, VPN configurations, Threat Prevention settings, policy installation, logging and monitoring,” a MVP contributor to Check Point’s CheckMates community forum noted.

“A vulnerability affecting the Management Plane can undermine the trust model of the entire security architecture. Even organizations whose Management Servers are not directly exposed to the Internet should not postpone remediation. Network restrictions reduce exposure, but they do not remove the vulnerable code.”

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-16232 to its Known Exploited Vulnerabilities catalog, and requires civilian US federal agencies to address it by July 25 and investigate whether they’ve been hit by attackers.

Additional flaws fixed

The jumbo hotfixes released by Check Point also fix:

• CVE-2026-62144, a similarly critical vulnerability that allows unauthenticated attackers to execute administrative commands on the Management Server and then allows them to execute commands on managed security gateways
• CVE-2026-62145, a vulnerability in Gaia Portal – the web-based management interface for Check Point’s Linux-based operating system that runs on management servers and security gateways – that allows an authenticated attacker with read-only access to run commands as root.

These are not known to be actively exploited, and the latter also affects Check Point firewalls (except Check Point Spark Gateways), not just the management servers.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!