Check Point SmartConsole Improper Authentication (CVE-2026-16232)

let LookbackPeriod = 1d;
CommonSecurityLog
| where TimeGenerated >= ago(LookbackPeriod)
| where DeviceVendor has "Check Point"
| where Activity has_any ("SmartConsole", "cpm", "cpmiserver") or Message has_any ("authentication", "login")
| where DestinationPort in (19009, 18190, 443) or Message has "SmartConsole"
| where (EventOutcome has_any ("Success", "success") and isnotempty(SourceUserName) == false) or Message has_any ("bypass", "unauthenticated", "anonymous")
| extend AccountName = coalesce(SourceUserName, "unknown")
| summarize AttemptCount = count(), Sources = make_set(SourceIP), Destinations = make_set(DestinationIP) by AccountName, DeviceProduct, bin(TimeGenerated, 5m)
| where AttemptCount >= 3
| project TimeGenerated, AccountName, DeviceProduct, AttemptCount, Sources, Destinations
| order by TimeGenerated desc

index=network_firewall sourcetype="checkpoint:*" OR sourcetype="cef" vendor="Check Point"
| eval is_smartconsole=if(match(dest_port, "19009|18190|443") OR match(_raw, "(?i)smartconsole"), 1, 0)
| where is_smartconsole=1
| eval has_auth_anomaly=if(match(_raw, "(?i)(bypass|unauthenticated|anonymous)") OR (match(_raw, "(?i)success") AND isnull(user)), 1, 0)
| where has_auth_anomaly=1
| bin _time span=5m
| stats count as attempt_count values(src) as sources values(dest) as destinations by _time, user, dest
| where attempt_count >= 3
| sort -_time

network where event.dataset : "checkpoint.firewall" and
  (destination.port in (19009, 18190, 443)) and
  (message : "*smartconsole*" or message : "*bypass*" or message : "*unauthenticated*" or message : "*anonymous*") and
  (related.user == null or user.name == null)

SELECT DATEFORMAT(devicetime, 'YYYY-MM-dd HH:mm:ss') AS EventTime, sourceip, destinationip, destinationport, username, LOGSOURCETYPENAME(logsourceid) AS logsource, UTF8(payload) AS RawPayload
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) ILIKE '%Check Point%'
AND (destinationport IN (19009, 18190, 443))
AND (UTF8(payload) ILIKE '%smartconsole%' OR UTF8(payload) ILIKE '%bypass%' OR UTF8(payload) ILIKE '%unauthenticated%' OR UTF8(payload) ILIKE '%anonymous%')
AND (username IS NULL OR username = '')
LAST 24 HOURS

_sourceCategory=*checkpoint* destport=19009 OR destport=18190 OR destport=443
| where isBlank(user) or _raw matches "*bypass*" or _raw matches "*unauthenticated*" or _raw matches "*anonymous*"
| parse "src=* dst=* dpt=*" as srcip, dstip, destport nodrop
| timeslice 5m
| count as attempt_count by _timeslice, srcip, dstip
| where attempt_count >= 3
| sort by _timeslice desc

rule cve_2026_16232_smartconsole_auth_bypass {
  meta:
    author = "df00tech"
    description = "Detects potential CVE-2026-16232 Check Point SmartConsole improper authentication exploitation"
    severity = "CRITICAL"
  events:
    $e.metadata.vendor_name = "Check Point"
    $e.target.port = 19009 or $e.target.port = 18190 or $e.target.port = 443
    $e.metadata.product_event_type != ""
    re.regex($e.security_result.summary, `(?i)(smartconsole|bypass|unauthenticated|anonymous)`)
    $e.principal.user.userid = ""
  match:
    $e over 5m
  condition:
    $e
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkConnectIP6
| RemotePort=19009 OR RemotePort=18190 OR RemotePort=443
| ProcessName=/(?i)(cpmiserver|cpm|smartconsole)/
| stats count(aid) as attempt_count by ComputerName, RemoteAddressIP4, RemotePort
| where attempt_count >= 3