{
  "Event": {
    "analysis": "1",
    "date": "2026-07-24",
    "extends_uuid": "",
    "info": "[Threat Intel] Check Point SmartConsole Authentication Bypass (CVE-2026-16232)",
    "protected": false,
    "publish_timestamp": "1785616359",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1785616359",
    "uuid": "aeb8fe55-dc3e-4a7f-90aa-080330539bc5",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#9c8729",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Create or Modify System Process - T1543\"",
        "relationship_type": ""
      },
      {
        "colour": "#7773ac",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"External Remote Services - T1133\"",
        "relationship_type": ""
      },
      {
        "colour": "#d4fd6f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Impair Defenses - T1562\"",
        "relationship_type": ""
      },
      {
        "colour": "#9feaf0",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploit Public-Facing Application - T1190\"",
        "relationship_type": ""
      },
      {
        "colour": "#b25e1b",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Use Alternate Authentication Material - T1550\"",
        "relationship_type": ""
      },
      {
        "colour": "#423494",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify System Firewall - T1562.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#5780f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Default Accounts - T1078.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#ecc598",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Account - T1136.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#9dfeaa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Abuse Elevation Control Mechanism - T1548\"",
        "relationship_type": ""
      },
      {
        "colour": "#20f80d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Command and Scripting Interpreter - T1059\"",
        "relationship_type": ""
      },
      {
        "colour": "#71ecdb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Manipulation - T1098\"",
        "relationship_type": ""
      },
      {
        "colour": "#7628f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Unix Shell - T1059.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#6d779a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Privilege Escalation - T1068\"",
        "relationship_type": ""
      },
      {
        "colour": "#bf2644",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Server Software Component - T1505\"",
        "relationship_type": ""
      },
      {
        "colour": "#a0cbec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Systemd Service - T1543.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#f055aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Create Account - T1136\"",
        "relationship_type": ""
      },
      {
        "colour": "#b06a8a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Domain or Tenant Policy Modification - T1484\"",
        "relationship_type": ""
      },
      {
        "colour": "#5300bd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Access Token - T1550.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"vulnerability\"",
        "relationship_type": ""
      },
      {
        "colour": "#170057",
        "local": false,
        "name": "rectifyq:sub-category=\"critical-vuln\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785150007",
        "to_ids": false,
        "type": "link",
        "uuid": "0cbfcd70-b710-4d6f-8c5f-496fe74affc3",
        "value": "https://op-c.net/blog/check-point-smartconsole-authentication-bypass-cve-2026-16232/",
        "Tag": [
          {
            "colour": "#6b003a",
            "local": true,
            "name": "workflow:todo=\"create-missing-misp-galaxy-cluster\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785150007",
        "to_ids": false,
        "type": "text",
        "uuid": "203a8420-5193-4494-8eee-9a5fec1b7a7b",
        "value": "Check Point has released urgent security updates addressing three critical vulnerabilities affecting Security Management, Multi-Domain Management, Quantum Security Gateway, and Gaia operating systems. The most severe vulnerability, CVE-2026-16232, allows unauthenticated remote attackers to bypass SmartConsole login and gain full administrative access to exposed Management Servers. The vulnerability has been actively exploited against customers with internet-exposed management infrastructure. Successful exploitation enables attackers to modify firewall policies, create administrator accounts, weaken security protections, and establish persistent access. Two additional vulnerabilities were patched: CVE-2026-62144 enabling unauthenticated command execution, and CVE-2026-62145 allowing privilege escalation from read-only to root access. CISA added CVE-2026-16232 to its Known Exploited Vulnerabilities catalog with an exceptionally short remediation deadline, reflecting the severity of this authentication bypass..."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785150007",
        "to_ids": false,
        "type": "text",
        "uuid": "0d69be79-16ff-4134-bde3-b78d5eecf69a",
        "value": "Name: Check Point SmartConsole Authentication Bypass (CVE-2026-16232)\nAuthor: AlienVault\nAdversary: \nTags: [\"smartconsole\", \"authentication bypass\", \"cve-2026-62145\", \"cve-2026-16232\", \"security management\", \"check point\", \"gaia portal\", \"privilege escalation\", \"cve-2026-62144\", \"exploitation\", \"network security\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1543\", \"T1133\", \"T1562\", \"T1190\", \"T1550\", \"T1562.004\", \"T1078.001\", \"T1136.001\", \"T1548\", \"T1059\", \"T1098\", \"T1059.004\", \"T1562.001\", \"T1078\", \"T1068\", \"T1505\", \"T1543.002\", \"T1136\", \"T1484\", \"T1550.001\"]\nIndustries: []"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785150007",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "eedb5b3c-f8bd-4365-8d6a-cf57a22c008f",
        "value": "CVE-2026-16232"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785150007",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "61fa917b-eaa0-4094-b2eb-f856d68bce54",
        "value": "CVE-2026-62144"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785150007",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "73c09fe6-c70b-408f-8c4d-5a6aabde5deb",
        "value": "CVE-2026-62145"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785601949",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "005464c6-04ea-456d-9345-33a0dabb43e7",
        "value": "139.28.37.250",
        "Tag": [
          {
            "colour": "#ee4d99",
            "local": false,
            "name": "asn:asn=\"47987\"",
            "relationship_type": ""
          },
          {
            "colour": "#998ac6",
            "local": false,
            "name": "asn:as-owner=\"DELTAHOST-KYIV\"",
            "relationship_type": ""
          },
          {
            "colour": "#02bf45",
            "local": false,
            "name": "asn:as-country=\"UA\"",
            "relationship_type": ""
          },
          {
            "colour": "#8651e1",
            "local": false,
            "name": "misp-galaxy:country=\"ukraine\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785601970",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "225233e6-c316-4767-abf2-cbeb9a439791",
        "value": "151.241.99.207",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785601995",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "75f92be4-5d31-450c-a76b-eed1b0af4a76",
        "value": "151.241.99.233",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602016",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "336a33eb-b973-4657-982a-8af384d4d66e",
        "value": "158.62.198.182",
        "Tag": [
          {
            "colour": "#b598ba",
            "local": false,
            "name": "asn:asn=\"394177\"",
            "relationship_type": ""
          },
          {
            "colour": "#e3243a",
            "local": false,
            "name": "asn:as-owner=\"SHIFT-HOSTING-LLC\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602037",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "9a6ed284-c98b-44ab-b33c-0c089d7ada12",
        "value": "192.142.10.99",
        "Tag": [
          {
            "colour": "#e6fbdc",
            "local": false,
            "name": "asn:asn=\"214036\"",
            "relationship_type": ""
          },
          {
            "colour": "#18a54c",
            "local": false,
            "name": "asn:as-owner=\"ULTAHOST-AS\"",
            "relationship_type": ""
          },
          {
            "colour": "#d16c37",
            "local": false,
            "name": "asn:as-country=\"US\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united states of america\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785602058",
        "to_ids": true,
        "type": "ip-dst",
        "uuid": "5ddb85c3-ecfd-4e74-bff7-30592af510e1",
        "value": "194.213.18.137",
        "Tag": [
          {
            "colour": "#7bf968",
            "local": false,
            "name": "asn:asn=\"62240\"",
            "relationship_type": ""
          },
          {
            "colour": "#9d2170",
            "local": false,
            "name": "asn:as-owner=\"CLOUVIDER Clouvider - Global ASN\"",
            "relationship_type": ""
          },
          {
            "colour": "#e1449b",
            "local": false,
            "name": "asn:as-country=\"GB\"",
            "relationship_type": ""
          },
          {
            "colour": "#0088cc",
            "local": false,
            "name": "misp-galaxy:country=\"united kingdom\"",
            "relationship_type": ""
          },
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}