Check Point SmartConsole Authentication Bypass Exploited

Check Point Security Management Server and Multi‑Domain Security Management Server (MDS) are vulnerable to a severe authentication bypass identified as CVE‑2026‑16232 with a CVSS score of 9.3 ¹. The flaw lets an attacker who has already compromised another system on the network—such as via phishing—to mimic legitimate administrators by reusing a valid session cookie without needing to steal passwords directly.

The vulnerability stems from SmartConsole’s use of session cookies that are neither properly invalidated nor bound to the client IP address. Once an attacker obtains a legitimate token they can replay it in subsequent requests, effectively elevating themselves to administrative level within the console.

A patch addressing this issue was released on June 6th; reports indicate active exploitation in the wild following disclosure. Organizations running affected versions must apply the update immediately and verify automated patching processes are functioning correctly.

Security specialists note that the lack of IP binding for session cookies mirrors past incidents such as Equifax’s 2017 breach, where unencrypted credentials exposed personal data across millions of users. While the current bypass does not expose data directly, attackers could gain full control over managed networks through administrative access, potentially leading to widespread compromise if left unchecked.

Given the severity rating and evidence of ongoing exploitation, Check Point recommends organizations conduct internal scans for signs of unauthorized activity before applying the patch. Monitoring logs for anomalous login patterns or repeated failed attempts may help identify compromised accounts early.

Prompt application of the June 6th patch, coupled with rigorous monitoring and verification of patch deployment, will mitigate potential abuse by malicious actors exploiting stolen session tokens.