CVE-2026-16232: 
CloudGuard Management Server 脆弱性の分析と軽減

CVE-2026-16232 is a critical authentication bypass vulnerability in the Check Point SmartConsole login process that allows unauthenticated remote attackers to obtain an application login token and use it to authenticate with full administrative privileges. It affects Check Point Quantum Security Management and Multi-Domain Security Management (MDS) across a wide range of versions: R77.30 through R81.10 (all end-of-support), R81.20 with Jumbo Hotfix Take 158 or below, R82 with Jumbo Hotfix Take 118 or below, and R82.10 with Jumbo Hotfix Take 36 or below. The vulnerability was disclosed and added to the CISA Known Exploited Vulnerabilities (KEV) catalog on July 22, 2026, with a due date of July 25, 2026 (CISA KEV). It carries a CVSS v3.1 base score of 9.1 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Check Point SK).

The vulnerability is classified as CWE-287 (Improper Authentication) and stems from a flaw in the SmartConsole login process that allows an attacker to obtain a valid application login token without providing credentials (GitHub Advisory). The attack is network-based, requires no privileges, no user interaction, and no special preconditions beyond internet access to the Management Server IP address — unless the administrator has restricted Trusted Clients (GUI clients) to specific IP addresses or subnets (Check Point SK). A technical root-cause analysis published by Rapid7 identified the mechanism as a Secure Internal Communication (SIC) distinguished name (DN) substitution flaw in the authentication flow, enabling token theft and impersonation (Rapid7 Technical Analysis). A public PoC exploit was released by Rapid7 researcher sfewer-r7 on GitHub on approximately July 28, 2026, and a Metasploit module was subsequently submitted (Rapid7 ETR).

Successful exploitation grants an unauthenticated remote attacker full administrative access to the Check Point Security Management Server or Multi-Domain Security Management Server, allowing them to read, modify, or delete all security policies and configurations across all managed firewalls (Check Point SK). This effectively gives the attacker control over the entire network security posture managed by the affected server, enabling them to disable firewall rules, create backdoor access, exfiltrate sensitive network topology and policy data, and facilitate lateral movement across the protected network. The scope of impact extends beyond the management server itself to all gateways and security enforcement points under its management, making this a high-impact supply-chain-style attack on network security infrastructure (CISA KEV, Rapid7 ETR).

CVE-2026-16232 is being actively exploited in the wild, confirmed by Check Point and CISA, with Check Point noting it has impacted a very small number of customers at time of disclosure (Check Point SK, CISA KEV). The vulnerability was added to the CISA KEV catalog on July 22, 2026, with a remediation due date of July 25, 2026. A public PoC was released by Rapid7 (GitHub: sfewer-r7/CVE-2026-16232) on approximately July 28, 2026, and a Nuclei detection template was also published; a Metasploit module pull request was submitted shortly after (Rapid7 ETR). The EPSS score is approximately 69.97–71.4% (99th percentile), indicating an extremely high probability of exploitation (GitHub Advisory). Known attacker IP addresses associated with exploitation include 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, and 139.28.37.250 (Check Point SK). The vulnerability is automatable and classified as having total technical impact by NVD SSVC.

1. Reconnaissance: Identify internet-facing Check Point Security Management Servers or Multi-Domain Security Management Servers using tools like Shodan or Censys, targeting systems with the SmartConsole management port (TCP 19009 or 443) exposed and no Trusted Client IP restrictions configured.
2. Identify vulnerable version: Confirm the target is running a vulnerable version (R77.30–R81.10, or R81.20 below Take 158, R82 below Take 118, R82.10 below Take 36).
3. Exploit the authentication bypass: Send a crafted request to the SmartConsole login endpoint that exploits the SIC distinguished name (DN) substitution flaw in the authentication process to obtain a valid application login token without providing legitimate credentials (Rapid7 Technical Analysis).
4. Authenticate as administrator: Use the obtained application token to authenticate to the Management Server via the SmartConsole API or GUI with full administrative privileges.
5. Modify security policies: With full admin access, alter firewall rules (e.g., permit inbound access, disable blocking rules), create new administrator accounts, exfiltrate network topology and policy data, or install persistent backdoors across all managed gateways (Check Point SK, Rapid7 ETR).

• Network: Inbound connections to the Management Server from the following known attacker IPs: 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, 139.28.37.250 (Check Point SK).
• Network: Unexpected SmartConsole management connections (TCP 19009/443) from untrusted or unknown external IP addresses.
• Logs: SmartConsole Audit Logs showing authentication events with Authentication method: application token from unexpected source IPs — query: Authentication method: application token in Logs & Monitor > Audit Logs View (Check Point SK).
• Logs: SmartConsole log entries showing policy changes, administrator account creation, or configuration modifications by unrecognized sessions or at unusual times.
• SmartConsole Query: (src:151.241.99.207 OR dst:151.241.99.207 OR src:151.241.99.233 OR dst:151.241.99.233 OR src:158.62.198.182 OR dst:158.62.198.182 OR src:192.142.10.99 OR dst:192.142.10.99 OR src:139.28.37.250 OR dst:139.28.37.250) in Logs & Monitor / Logs & Events (Check Point SK).

Check Point has released fixes in: Jumbo Hotfix Accumulator for R82.10 starting from Take 36, R82 starting from Take 118, and R81.20 starting from Take 158. Versions R77.30 through R81.10 are end-of-support and do not have patches; organizations running these versions should upgrade immediately (Check Point SK). As an immediate workaround, restrict Trusted Clients (GUI clients) to specific trusted IP addresses or subnets in SmartConsole under Manage & Settings > Permissions & Administrators > Trusted Clients — ensure the Type is never set to "Any". Additionally, protect management access with a firewall that restricts access to trusted IP addresses only and verify that implied rules for control connections are enabled. CISA's BOD 26-04 requires federal agencies to apply mitigations by July 25, 2026 (CISA KEV).

Check Point issued an urgent security advisory and blog post on July 22, 2026, confirming active exploitation and urging immediate action (Check Point Blog). Rapid7 published both an initial emergency threat response and a detailed technical analysis of the root cause, and released a public PoC on GitHub, significantly raising the exploitation risk (Rapid7 ETR). Security media including SecurityWeek, BleepingComputer, The Hacker News, Security Affairs, and HelpNet Security covered the vulnerability extensively, with widespread community discussion on Reddit and Mastodon highlighting the severity of exposing firewall management infrastructure to the internet (SecurityWeek, Security Affairs). The Canadian Centre for Cyber Security (CCCS), Belgium's CCB, and Portugal's CNCS also issued national advisories, reflecting broad government concern (CCCS Advisory). Community commentary noted this vulnerability exemplifies a broader trend of attacks targeting management-plane infrastructure.