Today’s digest is about the gap between “patched” and “actually fixed everywhere.” A Check Point management-console bypass moves from advisory to public exploit code, a two-decade-old server management protocol keeps leaking credentials from tens of thousands of exposed boxes, and a router flaw shows why unauthenticated root code execution on network edge devices never really gets old. Here’s what changed since yesterday’s digest.
Actively exploited watch: Public PoC lands for the Check Point SmartConsole authentication bypass already being exploited in the wild
Rapid7 Labs published a full root-cause technical analysis and a public proof-of-concept for CVE-2026-16232 (CVSS 9.3), a critical authentication bypass in the SmartConsole login process for Check Point Security Management Server and Multi-Domain Security Management Server (MDS). The flaw lets an unauthenticated attacker with network reach to the Management Server obtain an application login token, then use it to log into SmartConsole with full administrator privileges — enough to rewrite security policy or reconfigure the management plane outright. Check Point published its advisory on July 22 and confirmed exploitation against “a small number of customers”; CISA added the bug to its Known Exploited Vulnerabilities catalog with a July 25 remediation deadline for federal agencies. A Jumbo Hotfix is available now under sk185169. The Hacker News · Rapid7
A working public PoC against a bug already exploited in the wild is the signal to stop treating this as “on the patch backlog.” If you manage Check Point firewalls through SmartConsole, apply the Jumbo Hotfix now and check Management Server logs for login-token requests from IPs outside your known admin ranges — this is a full policy-rewrite capability, not just a console login.
Vulnerability watch: A critical OpenWrt DHCPv6 flaw lets unauthenticated attackers run code as root on routers
OpenWrt shipped 24.10.8 and 25.12.5 to fix CVE-2026-53921 (CVSS 9.8), a stack-buffer overflow in odhcpd — the daemon that handles DHCPv6 — triggerable by a single crafted DHCPv6 REQUEST from anyone able to reach the service, no authentication required. Because odhcpd runs as root and embedded router hardware typically lacks stack canaries or ASLR, a successful overflow is a realistic path to full device compromise rather than just a crash. Public Python proof-of-concept code for both overflow paths is already circulating. As of the patch release, researchers had not confirmed exploitation in the wild, but unauthenticated root bugs in network-edge daemons are exactly the profile that gets weaponized fast once a PoC exists. The Hacker News · Field Effect
Any OpenWrt-based router, access point, or CPE device you or your customers run at the network edge should move to 24.10.8 or 25.12.5 on the next maintenance window, not the next hardware refresh — DHCPv6 is enabled by default on most of these builds, and the exposure is to anyone on the local segment, not just the internet.
Exposure watch: Over 24,000 internet-exposed server BMCs are leaking password hashes through a 22-year-old IPMI flaw
Security researchers identified more than 24,000 internet-exposed Baseboard Management Controllers — the out-of-band admin interfaces built into server hardware — still vulnerable to CVE-2013-4786, an authentication weakness in the IPMI 2.0 protocol that lets an attacker request a password hash before ever logging in and crack it offline with a GPU rig. For roughly a third of the exposed devices, researchers cracked the password outright using dictionaries and the default-credential patterns printed on the hardware’s own factory label — a large share are Supermicro systems with a 10-character uppercase password stamped on the chassis under the username “ADMIN.” One exposed HPE iLO 4 panel was already showing a ransom note demanding 0.3 BTC. BleepingComputer · Hackread
A BMC compromise gives an attacker power-cycle, virtual-media, and out-of-band console access that survives an OS reinstall — it’s one of the worst places to leave a factory default. If your fleet includes physical servers, confirm IPMI and Redfish interfaces aren’t internet-facing, rotate any factory-stamped BMC credentials, and disable legacy IPMI 2.0 authentication where the vendor allows it.
Also noted: 7-Zip patches a heap overflow that crafted XZ archives can trigger during extraction
7-Zip 26.02, released June 25, fixes CVE-2026-14266, a High-severity (CVSS 7.0) heap-based buffer overflow in how the archiver handles XZ chunked data. Trend Micro’s Zero Day Initiative detailed the root cause on July 15: when an XZ stream runs its output through a filter, the vulnerable decoder was handed the full output-buffer length on every pass instead of the space actually left after prior writes, letting a crafted archive push data past the buffer’s real bounds during extraction. No public proof-of-concept or in-the-wild exploitation has been confirmed, but archive-extraction bugs are a reliable phishing-attachment vector once weaponized. The Hacker News · Security Affairs
7-Zip doesn’t auto-update, so this one only gets fixed if someone pushes it — worth a line item in your next patch cycle for endpoints where users routinely open unsolicited archives.
Final thought
Three of today’s four stories trace back to the same root pattern: a management interface — a firewall console, a router’s DHCP daemon, a server’s out-of-band controller — built to be trusted by definition, sitting exposed to a network it shouldn’t be reachable from. Patches exist for all four issues here; the work left is making sure they’re not just available but actually applied to the specific boxes sitting at your network edge. If you want help finding which of your internet-facing management interfaces carry that kind of hidden exposure, see our how-to guides or book a discovery call.