Check Point Management Products Affected by High-Severity Authentication Bypass Vulnerability CVE-2026-16232 Already Under Active Exploitation
Check Point Software Technologies has revealed a critical vulnerability in its security management products that permits authentication bypass and has already been exploited in real-world attacks.
The issue, identified as CVE-2026-16232, carries a High severity rating. It stems from a flaw in the SmartConsole login process that allows an attacker with network access to the Management Server to obtain administrator rights without providing valid credentials.
Once administrative access is achieved, threat actors could modify security settings, alter policies, and potentially compromise the entire protected environment.
The vulnerability affects the following appliance software versions: R82.10, R82, and R81.20. Older releases, including R77.30 and subsequent unsupported versions, are also impacted.
Check Point released its official security advisory on July 19, 2026, and strongly recommends that customers investigate possible intrusions and implement the necessary updates or workarounds without delay.
Related articles
CISA Adds SharePoint and Check Point SmartConsole Flaws to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency has added two vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation. CVE-2026-50522 affects Microsoft SharePoint and allows remote code execution through untrusted data deserialization, carrying a CVSS v3.1 base score of 9.8. A patch was released on July 14, 2026, though exploitation was not observed at the time of disclosure. CVE-2026-16232 impacts Check Point Software Technologies SmartConsole and stems from an authentication bypass that could let attackers obtain administrative privileges and alter security policies. CISA has directed federal agencies to remediate both issues by July 25, 2026, and Check Point has published associated malicious IP addresses. The agency warns that the flaws pose a broad exploitation risk beyond government systems.
Adobe Acrobat Chrome Extension Flaw Enabled Silent Theft of WhatsApp Web Conversations
A vulnerability in the Adobe Acrobat extension for Chrome allowed attackers to silently extract WhatsApp Web conversations, contacts, and account data without any user interaction beyond visiting a malicious page. The issue affected approximately 329 million browser installations and required no password theft or malware infection. Researchers at Guardio named the attack HermeticReader and traced it to an internal messaging flaw that let a hidden iframe execute unverified commands inside the extension. This activated the dormant Hermes integration mechanism, which acted as a bridge to WhatsApp Web and exfiltrated data in plaintext while the user viewed an ordinary webpage. Adobe received the report, fixed the bug in June, and assigned it CVE-2026-48294, classifying it as a UXSS vulnerability that enables cross-site data disclosure. The extension's failure to validate message sources allowed the malicious site to write data to local storage and trigger the integration without warnings.
From Hundreds of Alerts to Proven Vulnerabilities: INFERA AI.SafeCode Unifies Seven Scanners into a Single DevSecOps Pipeline
INFERA AI.SafeCode integrates seven distinct security scanners into one continuous analysis platform that automatically validates findings instead of flooding teams with unconfirmed alerts. The solution combines SAST, SCA, Secrets detection, DAST, AI-driven Pentest agents, Code Fuzzing, and API Fuzzing to deliver proof-of-exploit evidence for high-risk issues. By cross-validating results across engines, the platform reduces false positives and provides developers with actionable tasks that include reproduction steps, stack traces, and one-click AutoFix recommendations directly inside IDEs and Git workflows. Special attention is given to AI-generated code from tools such as GitHub Copilot, Cursor, and Claude, ensuring that rapid development does not introduce unvetted vulnerabilities. The system also maps full attack surfaces, tracks reachability from entry points to vulnerable sinks, and supports compliance requirements including FSTEC orders for critical information infrastructure. MLSecOps capabilities extend coverage to machine-learning pipelines, model configurations, and inference APIs. Overall, INFERA shifts AppSec from reactive alert triage to measurable risk management with clear MTTR metrics and SLA tracking.
Critical wp2shell Vulnerability Chain Exploited in WordPress for Unauthenticated Remote Code Execution and Webshell Deployment
A critical vulnerability chain dubbed wp2shell is being actively exploited against WordPress Core installations, enabling unauthenticated remote code execution and the installation of persistent webshells. The flaws affect versions 7.0.x prior to 7.0.2, 6.9.x prior to 6.9.5, and the 6.8 branch before 6.8.6, with patches now available. Attackers chain CVE-2026-63030 and CVE-2026-60137 through the WordPress REST API batch processing endpoint and an SQL injection in WP_Query via the author__not_in parameter. Observed campaigns involve mass scanning, user enumeration, attempts to read wp-config.php, and deployment of PHP webshells in wp-content/cache that return fake 404 responses. Administrators are urged to update immediately, audit logs for anomalous REST API requests, inspect for unauthorized admin accounts or plugins, and rotate credentials if wp-config.php exposure is suspected.