# CVE-2026-16232: Check Point SmartConsole Improper Authentication Vulnerability

- Exploited (CISA KEV): yes, added 2026-07-22
- Published: 2026-07-22
- CVSS: 9.3 CRITICAL (v4.0)
- EPSS: 3.5% (89th percentile)
- CWE: CWE-287

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-16232 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-16232