> Source: [sk185169](https://support.checkpoint.com/results/sk/sk185169)

# sk185169 - CVE-2026-16232 - Authentication bypass with SmartConsole login process using application token

| Property | Value |
|----------|-------|
| Solution ID | sk185169 |
| Date Created | 2026-07-19 |
| Last Modified | 2026-09-24 |
| Technical Level | General |
| Products | Security Management Server, Multi-Domain Security Management Server |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- * **Impact:** An unauthenticated attacker can obtain an application login token and use it to login via SmartConsole with full admin privileges and apply changes to the security policy and security configuration. Check Point identified this vulnerability is exploited in the wild, affecting a handful of customers with a very specific configuration.

* **Affected Products and versions** :   
  * Products: Security Management Server, Multi-Domain Security Management Server (MDS)
  * Product Versions: R77.30, R80, R80.10, R80.20, R80.30, R81 R81.10, R81.20, R82, R82.10
* **Conditions:** Successful remote exploit requires **internet access** to the Management Server IP address and **no restrictions** on **Trusted Clients** (GUI clients).

* This issue received the ID [CVE-2026-16232](https://www.cve.org/CVERecord?id=CVE-2026-16232).

*

  ### Mitigation

  1. Follow the [Check Point Hardening Best Practices Guide](https://sc1.checkpoint.com/documents/Check_Point_Gateway_and_Management_Hardening/CP_Check_Point_Gateway_and_Management_Hardening.pdf).  

  2. Limit **Trusted Clients** (GUI clients) to trusted IP addresses/subnets.   
     To do so,   
     1. In SmartConsole, go to **Manage \& Settings** \> **Permissions \& Administrators** \> **Trusted Clients**.
     2. Double-click the client you want to edit.
     3. In the **Trusted Client** configuration window that opens, change the settings as needed and.  
        Make sure do not use "Any" as a Type.
     4. Click **OK** .   

        ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk185152/Trusted_GUI202607220935111.png)
  3. Protect Management access with Firewall, restrict access to trusted IP addresses, and verify that implied rules for control connections are enabled. This will create an implied rule that will prevent management access for non-authorized IP addresses.

### How to Identify an Attack

1. In **SmartConsole** , go to **Logs \& Monitor / Logs \& Events** \> **Audit Logs View** and search for the query " `Authentication method: application token` ":

   ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk185169/token202607221152001.png)
2. In **SmartConsole** , go to **Logs \& Monitor / Logs \& Events** \> **Audit Logs View** and search for the query *"Authentication method: Password based application token"* . Any found events should be treated as suspicious and inspected for an unrecognized administrator name or IP address.  

3. In **SmartConsole** , go to **Logs \& Monitor / Logs \& Events** , and search for and review events where either the source or destination IP address matches a known attacker IP address (relevant for events before 2026-07-23).   

   **Attacker IP addresses**
   * 151.241.99.207
   * 151.241.99.233
   * 158.62.198.182
   * 192.142.10.99
   * 139.28.37.250
   * 194.213.18.137

   **SmartConsole query**

   `(src:151.241.99.207 OR dst:151.241.99.207 OR src:151.241.99.233 OR dst:151.241.99.233 OR src:158.62.198.182 OR dst:158.62.198.182 OR src:192.142.10.99 OR dst:192.142.10.99 OR src:139.28.37.250 OR dst:139.28.37.250 OR src:194.213.18.137 OR dst:194.213.18.137)`

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R82.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82.10/Default.htm) starting from Take 36
* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 118
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 158

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content