Check Point has released patches and mitigations for CVE-2026-16232, an authentication bypass in SmartConsole that has been observed exploited in the wild, allowing unauthenticated attackers to obtain an application login token and gain full admin access to Security Management and Multi-Domain Management. The flaw affects SmartConsole login processes and can let attackers alter security policies and configurations if the Management Server is internet-facing and Trusted Clients have no access restrictions. Check Point noted that exploitation has been limited to a small number of customers with exposed management environments, and it has published IoCs to aid detection. In response, CISA added CVE-2026-16232 to the Known Exploited Vulnerabilities catalog, with federal agencies directed to patch by July 25, and Check Point has warned administrators to restrict internet exposure and tighten trusted client access. The company also flagged additional related vulnerabilities and a jumbo hotfix released on July 22 as part of its ongoing remediation, while noting that the threat appears linked to real-world exploitation. Observers have noted the broader risk to exposed management planes and emphasized hardening steps and vigilant monitoring to prevent unauthorized configuration changes.