Check Point has issued security patches to rectify several vulnerabilities affecting its Security Management and Multi-Domain Management (MDSM) products. Among these is a critical flaw actively exploited in the field, necessitating immediate attention.
Details of the Critical Vulnerability
The primary security issue, designated as CVE-2026-16232 with a CVSS score of 9.3, is an authentication bypass vulnerability. This flaw affects the Check Point SmartConsole login mechanism, permitting remote attackers without authentication to acquire an application login token. This access could lead to full administrative control, enabling the modification of security policies and configurations.
For successful exploitation, attackers require internet access to the Management Server’s IP address, and the system must be configured without restrictions on Trusted Clients. Lotem Finkelstein, Check Point’s Vice President of Research, acknowledged that a limited number of customers have been impacted, and they have been informed accordingly. However, the specifics of these attacks remain undisclosed.
Additional Vulnerabilities and Recommendations
Beyond CVE-2026-16232, Check Point addressed two more vulnerabilities. CVE-2026-62144, another critical authentication bypass with a CVSS score of 9.3, allows unauthorized administrative command execution on the Management Server. Additionally, CVE-2026-62145, with a CVSS score of 7.5, involves improper privilege management in the Gaia Portal. This flaw lets authenticated users with read-only privileges execute commands as root.
These vulnerabilities affect versions R77.30 through R82.10. Users are urged to implement the July 22 Jumbo hotfix, limit Trusted Clients to specific IP addresses, and secure Management access with Firewall protection. CISA has added these flaws to its Known Exploited Vulnerabilities catalog, mandating fixes by July 25, 2026.
Indicators of Compromise and Security Measures
Check Point has released several Indicators of Compromise (IoCs) linked to the exploited vulnerabilities. These include IP addresses such as 151.241.99[.]207 and 192.142.10[.]99. Organizations should monitor network traffic for these IoCs and take appropriate action if detected.
In conclusion, applying the provided patches and following the recommended security measures are critical steps to mitigate the potential risks posed by these vulnerabilities. Organizations must remain vigilant and proactive in securing their systems against such threats.
