Check Point SmartConsole Authentication Bypass Technical Analysis (CVE-2026-16232)

Overview On July 22, 2026, Check Point published a security advisory for CVE-2026-16232 , an authentication bypass in the SmartConsole login process affecting Security Management Server and Multi-Domain Security Management Server (MDS). By leveraging CVE-2026-16232, an unauthenticated attacker can obtain an application login token, use this token to log in through SmartConsole with full administrator privileges, and modify the security policy or security configuration. Exploitation requires network access to the Management Server and for a Trusted Clients configuration that does not restrict GUI clients, which in our testing was a default setting. This vulnerability was reported as being exploited in the wild as a zero-day vulnerability at the time of disclosure. Our analysis finds that the root cause of CVE-2026-16232 is a broken trust boundary in the application authentication path. A vulnerable server accepts an attacker-supplied Secure Internal Communication (SIC) distinguished name (DN) as the identity of a remote application instead of binding that identity to the authenticated remote peer certificate DN returned by getCertificateDnName() . An attacker can read the management server's own SIC DN during the unauthenticated bootstrap communication, replay that DN in a forged application certificate bind, obtain an application token, and then ask the legacy management service to mint a new SmartConsole single sign-on (SSO) ticket. Rapid7 Labs has reproduced CVE-2026-16232 against affected R81.20 and R82.10 versions of the target software. Our proof-of-concept (PoC) exploit script can be used to successfully validate if a target is either vulnerable or patched. The vendor supplied patches have been confirmed to successfully remediate the vulnerability and prevent our PoC script from succeeding. Analysis SmartConsole is the desktop client administrators use to manage Check Point policy and configuration. A SmartConsole login crosses two generations of management plumbing over the network. The first is the legacy FWM/CPMI service, listening on TCP 18190 . It uses SIC, Check Point's certificate-based trust mechanism for communication between management components. Once the SIC bootstrap completes, FWM exchanges length-prefixed “FwSet” objects, a Check Point name/value encoding used by older management services. The second is the newer CPM/DLE service. This exposes SOAP services over HTTPS on TCP 19009 under the URI path /cpmws/ . SmartConsole uses these services for login, queries, and object operations. Authenticated requests carry DLESESSIONID and CLIENTSESSIONID header values to prove a client is authenticated. The exploit for CVE-2026-16232 uses both the FWM/CPMI and CPM/DLE services. It first uses the native FWM/CPMI protocol to claim an application identity and obtain an application token via the root cause of the vulnerability. It then uses the accepted native application session to ask FWM for a SmartConsole SSO ticket, redeems the ticket over CPM's SOAP API, and receives a SmartConsole session. The diagram below shows the flow for exploiting CVE-2026-16232. Figure 1: Flow diagram of exploitation. The application authentication boundary The Java login service contains a bridge for FWM application based logins. The authenticateUser method splits the supplied username into an application name and a SIC DN, then passes both into cpApplicationAuthentication() . // Source: work/t146/mgmt_wrapper.tgz:fw1/cpm-server/dleserver.jar.full!/com/checkpoint/management/dleserver/coresvc/internal/LoginSvcImpl.class private AuthenticationResponse authenticateUser(AuthenticationInfoBase authenticationInfoBase, String string, String string2, CPUUID cPUUID, boolean bl, LockAdminInfoContainer lockAdminInfoContainer, ExternalLoginInfo externalLoginInfo) throws AuthenticationFailureLoginException, LicenseExpiredLoginException { // ... } else if (authenticationInfoBase instanceof FwmAuthenticationInfo) { object2 = authenticationInfoBase.getUsername(); int n = ((String)object2).toLowerCase().lastIndexOf("cn="); object = (FwmAuthenticationInfo)authenticationInfoBase; if (FwmLoginType.APPLICATION.equals((Object)object.getFwmLoginType())) { String suppliedSicDn = ((String)object2).substring(n); // SmartConsole a0eebc99-afed-4ef8-bb6d-fedfedfedfed system_admin 512d49aa4c026d57177bea06dd28669c889479bfa8ea6d3b53fabe59ec9e0a2e The loginNew response returns the two identifiers that SmartConsole uses for later requests: ZMKhaQEsZ7bkMSlMVR7ARhvQIeTCdqwlvrcN-Ux4CvI hRA3CPLRpTalxBIiv3miYGFlLy6JNHYQwqcKhD4Aktg At this point, the attacker has moved from unauthenticated network access to a SmartConsole session identified by sid and clientSessionId . Ticket redemption is also the step that produces the advisory's log based IOC, with a message “Authentication method: application token” logged in the audit log, as shown in Figure 2 below. Figure 2: Audit Log IOC. Exploitation Our PoC implements the minimum SIC/CPMI bootstrap needed to obtain the application token, mint the SmartConsole ticket, redeem it over SOAP, and display the results of several privileged operations before and after ticket redemption . The following shows our PoC running against a vulnerable R81.20 target. $ python3 CVE-2026-16232.py --target 192.168.86.15 [+] Targeting: 192.168.86.15 [+] SIC/CPMI connected [+] Forged application DN: cn=cp_mgmt,o=gw-5622ca..5otbwa [+] Application bind succeeded [+] Application token obtained: XYB8PbLoXXnMx4J7W45UK-BhrjWkolvihp0P98G2qDc [+] getServerInfo hostName: gw-5622ca hostIpAddress: 192.168.86.15 osName: Linux osVersion: 3.10.0-1160.15.2cpx86_64 [+] Application token GetAllAdmins count: 0 [+] SmartConsole application-token ticket redeemed: 34bd621cc8855634fd97484fec258a18eb14eb8feb14b22c260a4accba715808 [+] GetAllAdmins count: 6 admin: UNIX_PASSWORD Remote CPM Server_cn=cp_mgmt,o=gw-5622ca..5otbwa: INTERNAL_PASSWORD upgrade_cn=cp_mgmt,o=gw-5622ca..5otbwa: INTERNAL_PASSWORD admin_cn=cp_mgmt,o=gw-5622ca..5otbwa: INTERNAL_PASSWORD SmartView Reporter Client_cn=cp_mgmt,o=gw-5622ca..5otbwa: INTERNAL_PASSWORD CPM Server_cn=cp_mgmt,o=gw-5622ca..5otbwa: INTERNAL_PASSWORD For the purpose of demonstrating the vulnerability and the level of access the authentication bypass achieves, the PoC uses the authentication bypass to access some protected resources. Specifically, the PoC retrieves some basic system information via a call to getServerInfo , and retrieves the SmartConsole admin accounts via a call to GetAllAdmins . First, the PoC uses the application token as a DLESESSIONID value for PerformanceTestSvcRemote.getServerInfo . The same SOAP method returns a fault without a valid session, while the application token returns the server information The PoC then sends the same GetAllAdmins query twice, once with the application token and once with the redeemed SmartConsole session. Using only the application token receives a successful query response with zero visible records, while using the redeemed SmartConsole session receives all records available. Running the same PoC against a patched R82.10 target shows the malicious application bind request failing. $ python3 CVE-2026-16232.py --target 192.168.86.16 [+] Targeting: 192.168.86.16 [+] SIC/CPMI connected [+] Forged application DN: cn=cp_mgmt,o=gw-5622cc..tmbpin [-] Application bind failed. The target is likely patched and not vulnerable. Remediation For remediation guidance, please see Rapid7’s Emergent Threat Response blog for CVE-2026-16232 which contains further details.