Security researchers at Rapid7 have published a working proof-of-concept script for CVE-2026-16232, a critical authentication bypass in Check Point’s Security Management Server and Multi-Domain Security Management Server (MDS). The flaw, which carries a CVSS score of 9.3, lets an unauthenticated attacker on the network obtain an application login token and connect to SmartConsole — Check Point’s central firewall management interface — with full administrator privileges, without ever supplying a password.
The root cause is a broken trust boundary in the application authentication path: a vulnerable server accepts an attacker-supplied identity string during the initial handshake instead of verifying it against the authenticated certificate. An attacker can read the management server’s own identity during the unauthenticated bootstrap phase, replay it back, and receive a valid session token. From there they can modify firewall rules and security policies as if they were a legitimate admin. Check Point has confirmed active exploitation as a zero-day in a small number of customer environments and released Jumbo Hotfixes on July 22, 2026. Rapid7’s PoC script can be used to verify whether a given server is vulnerable or already patched.
How to check if you’re affected
Affected products are Check Point Security Management Server and Multi-Domain Security Management Server (MDS) versions before the Jumbo Hotfixes released on July 22, 2026. Log in to your Check Point management console and verify the July 22 hotfix has been applied. Administrators can also run Rapid7’s published validator script to test whether their management server accepts an unauthenticated application login — a successful login without credentials means the system is still vulnerable.