Hackers Are Actively Exploiting a Flaw in Check Point Security Software
A newly discovered hole in Check Point's network management tools let attackers log in as administrators without a password. Real attacks were already happening before the patch arrived.
Key points
- CVE-2026-16232 is an actively exploited flaw in Check Point Security Management and Multi-Domain Management software that lets attackers gain full administrator access without a password.
- Check Point confirmed a limited number of customers with internet-facing management systems were hit before a patch was released.
- CISA added the flaw to its Known Exploited Vulnerabilities catalog on Wednesday and ordered federal agencies to fix it by 25 July.
- Qilin, a ransomware group that encrypts victims' files and demands payment, has recently been observed targeting Check Point appliances.
- CVE-2026-62144 and CVE-2026-62145 were patched at the same time, though neither has been exploited in the wild.
Check Point sells software that companies use to manage the firewalls and security rules protecting their networks. Think of it as a control room for a building's entire alarm system. This week, the company confirmed that criminals found and used a secret back door into that control room before anyone knew it existed.
What exactly went wrong?
The flaw, tracked as CVE-2026-16232, is an authentication bypass: the software can be tricked into handing out an administrator login token without checking whether the person asking is allowed in. That token opens Check Point's SmartConsole management interface with full admin rights, letting an attacker rewrite security policy and effectively disable the locks protecting the organisation.
Check Point found the vulnerability internally. When they looked closer, it had already been used against real customers.
| Vulnerability | Severity | Products affected | Exploited in the wild |
|---|---|---|---|
| CVE-2026-16232 | Critical | Security Management, Multi-Domain Management | Yes |
| CVE-2026-62144 | Critical | Security Management, Multi-Domain Management | No |
| CVE-2026-62145 | High | Firewall, Multi-Domain Management, Multi-Domain Log Server | No |
Should customers be worried?
If your organisation uses Check Point management products and they're directly reachable from the open internet with no IP restrictions, yes. That's precisely the configuration attackers targeted.
Check Point says only a limited number of customers were hit, and those organisations have been privately notified. Patches and mitigations are available now. The company also released indicators of compromise, digital fingerprints of the attack that security teams can search for in their own logs.
This is the third Check Point vulnerability added to CISA's Known Exploited Vulnerabilities list. CVE-2026-50751 had been exploited as a zero-day in May; CVE-2024-24919 was leveraged throughout 2024. Check Point management interfaces keep appearing in real attack chains, and that's a pattern worth taking seriously.
We first covered CVE-2026-16232 on 23 July in "Check Point Rushes Fix for SmartConsole Flaw Already Being Exploited", when it was clear the vendor was racing a live exploit.
What about the ransomware angle?
No group has been formally identified as responsible for the CVE-2026-16232 attacks. Qilin has recently been observed probing Check Point appliances, as first reported by SecurityWeek. Whether they're behind these specific intrusions isn't confirmed. We've tracked the group across five stories in the last 90 days, including their exploitation of Palo Alto VPN flaws just days ago.
For anyone whose employer or service provider runs Check Point tools: an attacker controlling a security management system can quietly disable defences before the real damage begins. Watch for unusual incident communications from businesses you rely on over the coming weeks.
The blunt truth is that management interfaces should never sit on the raw internet without an IP allowlist. That one configuration choice is the difference between this patch being a Tuesday morning task and a breach being a foregone conclusion.
