Public PoC Released for Exploited Check Point SmartConsole Authentication Bypass
Cybersecurity researchers have shared additional technical details about a recently patched critical security flaw impacting Check Point Security Management Server and Multi-Domain Security Management Server (MDS) that has come under active exploitation in the wild.
Intelligence analysis by Llama
A recently patched critical security flaw in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) has come under active exploitation in the wild. Cybersecurity researchers have shared additional technical details about the vulnerability.
Imagine you have a super powerful computer that can control many other computers. If someone can trick the computer into thinking they are the boss, they can do anything they want. This is what happened with Check Point's computer system. Someone found a way to trick it into thinking they were the boss, so they could do bad things. But now, Check Point has fixed the problem, so it can't happen again.
Analysis
A Critical Security Flaw in Check Point SmartConsole
Cybersecurity researchers have shared additional technical details about a recently patched critical security flaw impacting Check Point Security Management Server and Multi-Domain Security Management Server (MDS) that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-16232, is an authentication bypass in the SmartConsole login process that allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.
According to Rapid7, the root cause of the vulnerability is a "broken trust boundary" in the application authentication path that permits the threat actor to log in to a vulnerable appliance via SmartConsole with full admin privileges. Specifically, a vulnerable server has been found to accept an attacker-supplied Secure Internal Communication (SIC) distinguished name (DN) as the identity of a remote application as opposed to binding that identity to the authenticated remote peer certificate DN returned by a function named "getCertificateDnName." As a result, an attacker can read the management server's own SIC DN during the unauthenticated bootstrap communication and authenticate as a remote application by replaying that management server's DN, obtaining an application login token, and then minting a new SmartConsole single sign-on (SSO) ticket via the forged application session.
The patch introduced by Check Point ensures that remote clients use the authenticated remote peer certificate DN, causing any mismatch between the supplied DN and that authenticated identity to be rejected. It also adds a new empty identity check that prevents a remote application login when there is no authenticated SIC identity. "To make the supplied server DN survive the patched checks, the attacker would need an authenticated client certificate whose subject DN already matches that server DN, which removes the unauthenticated bypass," Rapid7's Stephen Fewer said.
Rapid7 has released a proof-of-concept (PoC) Python script that can be used to successfully validate whether a target is either vulnerable or patched against the flaw. Customers are advised to apply the Jumbo Hotfixes released by Check Point on July 22, 2026, to remediate the flaw as soon as possible.
Key points
- A critical security flaw in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) has been patched.
- The vulnerability, tracked as CVE-2026-16232, is an authentication bypass in the SmartConsole login process.
- Rapid7 has released a proof-of-concept (PoC) Python script to validate whether a target is vulnerable or patched.
- Customers are advised to apply the Jumbo Hotfixes released by Check Point on July 22, 2026, to remediate the flaw.
Check Point has released a patch to fix the vulnerability, and customers are advised to apply it as soon as possible. This should prevent further exploitation of the flaw.
The vulnerability has already been exploited in the wild, and it's unclear how many systems may be affected. It's also possible that the attacker may have obtained sensitive information or caused damage to the affected systems.
