Exploit for Check Point SmartConsole (CVE-2026-16232) for Sale

Exploit for Check Point SmartConsole (CVE-2026-16232) for Sale

For informational purposes only.

Vulnerability type: Authentication Bypass → unauthenticated administrative access
Affected versions: R81.10, R81.20, R82, R82.10, and earlier versions
Price: $3,000; the seller claims the exploit will be sold to three buyers

The author claims to be selling a fully weaponized exploit for CVE-2026-16232, a critical authentication bypass vulnerability affecting the Check Point SmartConsole login process.

According to Check Point, the flaw allows a remote, unauthenticated attacker to obtain an application login token and use it to gain full administrative access.

The seller claims that successful exploitation provides full administrative access for approximately two hours, after which the exploit must be run again to obtain a new session. The seller also claims the exploit can be used to create new administrator accounts and modify the system configuration.

For remote exploitation, the Management Server must be reachable by the attacker over the network, and the Trusted Clients configuration must not restrict access exclusively to trusted IP addresses. No prior authentication is required.

CVE-2026-16232 was publicly disclosed and patched on July 22, 2026. Check Point confirmed that the vulnerability had been exploited in the wild against a small number of customers, and CISA added it to its Known Exploited Vulnerabilities (KEV) catalog.