Check Point has released security updates to address three (3) high-severity vulnerabilities affecting its Security Management and Multi-Domain Security Management (MDSM) products, including the actively exploited zero-day CVE-2026-16232 (CVSS 9.3), an authentication bypass flaw that allows unauthenticated remote attackers to obtain a SmartConsole login token and authenticate with full administrative privileges. Successful exploitation enables attackers to modify security policies and configurations, though attacks require management servers to be directly exposed to the internet without firewall protections or Trusted Client IP restrictions. Check Point confirmed that a limited number of customers have been targeted, privately notified affected organizations, and published indicators of compromise (IoCs), but has not attributed the attacks, although the Qilin ransomware group has recently been observed targeting Check Point appliances. The company also patched CVE-2026-62144, a critical authentication bypass vulnerability that enables unauthenticated execution of administrative commands on management servers, and CVE-2026-62145, a high-severity privilege escalation flaw affecting Gaia Portal and related management components that allows authenticated users with limited privileges to gain root access. All three (3) vulnerabilities impact multiple product versions, and customers are urged to install the July 22 Jumbo Hotfix, restrict management access to trusted IP addresses, enable firewall protections, and review internet-exposed management interfaces. Due to confirmed in-the-wild exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-16232 to its Known Exploited Vulnerabilities (KEV) catalog, requiring U.S. federal agencies to remediate affected systems by no later than July 25, 2026.