Check Point Issues Urgent Fixes for Critical Exploited SmartConsole Vulnerability CVE-2026-16232
Check Point has released urgent security updates to address a critical vulnerability in SmartConsole that is already being exploited in active attacks.
The flaw, identified as CVE-2026-16232, carries a CVSS score of 9.3 and enables remote attackers without authentication to obtain a valid access token for the management environment. Once inside, attackers can modify security policies and protected configurations.
Successful exploitation depends on a specific configuration where the management server is directly exposed to the internet without IP address restrictions for trusted clients.
Check Point has identified attacks targeting a small number of customers and has already notified the affected organizations. The vulnerability impacts Security Management and Multi-Domain Management products across versions R81.10, R81.20, R82, R82.10, and earlier releases.
Customers using Smart-1 Cloud are already protected against this issue.
Additional Vulnerabilities Addressed
The same Jumbo Hotfix package, released on July 22, 2026, also resolves CVE-2026-62144, which allows execution of administrative commands without authentication, and CVE-2026-62145, which permits a read-only user in the Gaia Portal to escalate privileges to root level.
Related articles
WordPress Issues Critical Security Update 7.1.2 Five Days After Previous Patch
WordPress has released version 7.1.2 to fix a new critical vulnerability that was not addressed in the 7.1.1 update issued just five days earlier. The flaw, tracked as CVE-2026-87902, is a path traversal issue rated Critical that can be exploited without authentication. It resides in the page template resolution process and allows execution of arbitrary local PHP files located outside the theme directory, provided certain conditions such as the presence of a page- prefixed directory in the parent or child theme are met. The update was published on September 22, 2026, and affects the prior release from September 17. Administrators are urged to apply the patch immediately to prevent potential remote code execution.
F5 BIG-IP APM Vulnerability CVE-2026-94127 Allows Remote Code Execution, Already Exploited in the Wild
F5 has disclosed a critical heap-based buffer overflow vulnerability in BIG-IP Access Policy Manager that is already being actively exploited. The flaw, tracked as CVE-2026-94127, affects systems configured as an OAuth authorization server with both an access policy and OAuth profile applied to a virtual server. Successful exploitation can result in arbitrary code execution from crafted network traffic. The issue also impacts appliance mode configurations. F5 rates the vulnerability 9.3 under CVSS v4.0 and 9.8 under CVSS v3.1, classifying it as Critical. The company discovered the flaw internally and has confirmed real-world exploitation, urging immediate patching and compromise assessment.
ZeroNights 2026 Conference Program Highlights Offensive Security Research Across 30+ Talks
The ZeroNights 2026 conference program has been announced, featuring three tracks, four stages, and over 30 speakers focused on advanced offensive techniques, vulnerability discovery, and secure development practices. The event will take place on September 30, 2026, in Saint Petersburg at LOFT#7. Key presentations on the Offensive Track cover femtocell security, mobile operator advertising API exploitation, Trusting Trust attacks on the JDK, Rust memory safety limitations, and AMD SMM vulnerabilities including CVE-2025-54502. Additional talks examine Qualcomm BootROM flaws such as CVE-2026-25262, Linux kernel exploitation via CVE-2026-31695, Semtech LR11xx chip vulnerabilities, and reverse engineering of Dexprotector. The program emphasizes practical research into binary exploitation, side-channel analysis, and cross-chain bridge attacks.
BigDiskBuster Exploit Blocks Microsoft Defender Updates on All Supported Windows Versions
Security researcher Abdelhamid Naseri, known as Nightmare Eclipse, has released BigDiskBuster, a new exploit targeting Microsoft Defender that prevents the platform and antivirus signatures from receiving updates. The tool leaves Windows systems protected only by an outdated threat database while the interface continues to display normal status indicators. BigDiskBuster works across all currently supported Windows versions but requires continuous background execution. The researcher has published the source code on GitHub and acknowledged that the current implementation contains bugs requiring further refinement. The technique closely resembles the earlier UnDefend tool released in April, which similarly interfered with Defender update mechanisms. Naseri has disclosed nearly a dozen proof-of-concept exploits since April affecting Microsoft Defender, BitLocker, and other Windows components, including ShieldCrash, ShieldBreak, RoguePlanet, LegacyHive, BlueHammer, RedSun, YellowKey, and Plasma variants. Microsoft has not yet issued a patch for BigDiskBuster and previously criticized uncoordinated public disclosures of working exploits.