CVE-2026-16232 — CVE & Security Advisory Radar

🎯 CVE-2026-16232 CRITICAL 9.3 🔥 EPSS 73.3% ⚠️ CISA KEV · 43 T 🔓 Exploited 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2026-16232 | An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Cl

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.

Klassifikation & Betroffenheit:

checkpoint Multi-Domain Security Management R81.20 with Jumbo Hotfix Take 158 or belowQuantum Security Management R81.20 with Jumbo Hotfix Take 158 or belowMulti-Domain Security Management R82.10 with Jumbo Hotfix Take 36 or belowQuantum Security Management R82 with Jumbo Hotfix Take 118 or belowMulti-Domain Security Management R82 with Jumbo Hotfix Take 118 or belowMulti-Domain Security Management R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30Quantum Security Management R82.10 with Jumbo Hotfix Take 36 or belowQuantum Security Management R81.10, R81, R80.30, R80.20, R80.10, R80, and R77.30

Improper Authentication 🎯 High

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

🛡️ Empfohlene Mitigation: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-22 · Exploiting Trust in Client (High) CAPEC-57 · Utilizing REST's Trust in the System Res… (Very High) CAPEC-114 · Authentication Abuse (Medium) CAPEC-115 · Authentication Bypass (Medium) CAPEC-151 · Identity Spoofing (Medium) CAPEC-194 · Fake the Source of Data (Medium) CAPEC-593 · Session Hijacking (Very High) CAPEC-633 · Token Impersonation (Medium)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1040 · Network Sniffing T1548 · Abuse Elevation Control Mechanism T1185 · Browser Session Hijacking T1550.001 · Use Alternate Authentication Mater… T1563 · Remote Service Session Hijacking T1134 · Access Token Manipulation

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-18574 9.3 CVE-2026-50751 9.3 CVE-2026-62144 9.1 CVE-2024-24919 8.6 CVE-2026-48132 8.1

🧪 Exploit-Evidenz:

🐙 WadesWeaponShed/Check-Point-Trus 🐙 sfewer-r7/CVE-2026-16232 🐙 HackSpeak/CVE-2026-16232

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2026

Veröffentlicht 07/2026

Im KEV seit 07/2026

Heute 03.09.

CVSS-Vektor-Analyse: 9.3

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Keine

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Veröffentlicht:22.07.2026

Aktualisiert:10.08.2026 19:59

Assigner (CNA):checkpoint

EUVD-ID:EUVD-2026-47700

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-287: Improper Authentication ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	2026-08-29	2026-09-02
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

9.3 CRITICAL

🇪🇺 EUVD ⚠️ KEV

EPSS

73.3%

CVE-2026-16232 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

🔓 checkpoint

CVE-2026-16232 | An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Cl

CWE-287: Improper Authentication ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

22.07.2026

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub