SmartConsole
Check Point's GUI application for managing security policies and devices.
Check Point's management servers, which SmartConsole drives, took a second exploited flaw on 22 September 2026, when US authorities listed CVE-2026-93616 two months after a SmartConsole login bypass.
Last refreshed: 12 October 2026
Why do attackers keep going after Check Point's management console?
Timeline for SmartConsole
Mentioned in: Two 9.8 Check Point flaws hit firewalls
Cybersecurity: Threats and DefencesBackground
SmartConsole is the application administrators use to set security policy on Check Point management servers, and through them on the devices those servers control.
Its login process carried CVE-2026-16232, an authentication bypass that CISA listed as exploited on 22 July 2026. According to Check Point's CVE record, an unauthenticated remote attacker could obtain an application login token, sign in with full administrative rights and rewrite security policy. The attack worked only where the management server was reachable from the internet and Trusted Clients were unrestricted.
Check Point's defence for that flaw and for September's CVE-2026-93616 is the same: the Trusted Clients setting, found in SmartConsole under Permissions & Administrators, which limits logins to trusted internal IP addresses.
SmartConsole servers face a second exploited flaw
On 22 September 2026 the US exploited-flaw catalogue added CVE-2026-93616, which gives script execution on Check Point management and log servers over TCP port 19009. Those are the servers SmartConsole administrators log into, and Check Point said a handful of customers had been hit. Federal agencies had until 25 September.
It was the second listing against the SmartConsole side of Check Point's estate in two months. In July CISA had added CVE-2026-16232, a login bypass that handed an outsider an administrator token. Both times Check Point pointed customers to the same lever, restricting Trusted Clients to trusted internal addresses. A gateway flaw listed on 22 September needed its own update, so patching the firewall alone left the console exposed.