ET EXPLOIT Check Point CPMI Protocol Authentication Bypass via Application Login (CVE-2026-16232)

alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] 18190 (
    msg:"ET EXPLOIT Check Point CPMI Protocol Authentication Bypass via Application Login (CVE-2026-16232)";
    flow:established,to_server;
    content:"|3a|DN|20 28 22|cn|3d|";
    pcre:"/^[^\x2c]*?\x2c[oO]\x3d[^\x22]*?\x22\x29/R";
    content:"|3a|certificate_bind|20 28|"; fast_pattern;
    pcre:"/^(?:1|[tT][rR][uU][eE])\x29/R";
    content:"|3a|application_login|20 28 22|";
    content:"|01 01 0e 02 00 00 00 03|";
    byte_test:4,=,0,4,relative,big;
    byte_test:4,=,2,8,relative,big;
    reference:url,www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232/;
    reference:cve,2026-16232;
    classtype:attempted-admin;
    sid:2071347; rev:3;
    metadata:attack_target Server, tls_state TLSDecrypt, created_at 2026_07_29, cve CVE_2026_16232, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category WEB_SERVER, confidence Medium, signature_severity Major, tag Exploit, updated_at 2026_07_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;
    target:dest_ip;
)