Known vulnerability record

CVE-2026-16232

Check Point SmartConsole Improper Authentication Vulnerability

Stable IDcve:CVE-2026-16232Source record date2026-08-10Human reviewNot recordedProvenanceSource-linked CVE, KEV, and EPSS signals

Summary

Check Point SmartConsole Improper Authentication Vulnerability

Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.

Vulns.co field classification

Identity boundary on identity service

Derived analysis: these labels are inferred from the source title, product, and summary. They are not vendor, CVE, CISA, or FIRST classifications.

Failure classIdentity boundary

Product laneIdentity service

Attention stateKnown exploited, ransomware use unknown

Hunter pivot

Diagram the identity state machine. Compare two controlled identities across alternate routes, token audiences, role changes, recovery flows, and session rotation. Change one property per request.

Signals

Keep the signals separate

CVSS severitycriticalScore 9.3 · source checkpoint

EPSS probability89.1%Probability of exploitation in the next 30 days; not severity

CISA KEVKnown exploitedAdded 2026-07-22

Ransomware useunknownPreserved as known / unknown, not a truthy default

Research boundary

Confirm the product before the behavior.

Match the exact product, build, deployment mode, and exposed component.
Read the vendor advisory and current program policy.
Choose one non-destructive discriminator with an explicit negative control.
Stop at the first sufficient proof. A CVE match is context, not permission.

Timeline

Dates and provenance

CVE published: 2026-07-22
CVE modified: 2026-08-10
KEV date added: 2026-07-22
Dataset fetched: 2026-08-25T13:17:14.872Z

Sources

Original records

Version history: normalized permanent page created 2026-08-20. Machine-enriched fields remain source-attributed.