alert tcp any any -> [$HOME_NET,$HTTP_SERVERS] 18190 (msg:"ET EXPLOIT Check Point CPMI Protocol Authentication Bypass via Application Login (CVE-2026-16232)"; flow:established,to_server; content:"|3a|DN|20 28 22|cn|3d|"; pcre:"/^[^\x2c]*?\x2c[oO]\x3d[^\x22]*?\x22\x29/R"; content:"|3a|certificate_bind|20 28|"; fast_pattern; pcre:"/^(?:1|[tT][rR][uU][eE])\x29/R"; content:"|3a|application_login|20 28 22|"; content:"|01 01 0e 02 00 00 00 03|"; byte_test:4,=,0,4,relative,big; byte_test:4,=,2,8,relative,big; reference:url,www.rapid7.com/blog/post/ra-check-point-smartconsole-authentication-bypass-technical-analysis-cve-2026-16232/; reference:cve,2026-16232; classtype:attempted-admin; sid:2071347; rev:3; metadata:attack_target Server, tls_state TLSDecrypt, created_at 2026_07_29, cve CVE_2026_16232, deployment Perimeter, deployment Internal, deployment SSLDecrypt, former_category WEB_SERVER, confidence Medium, signature_severity Major, tag Exploit, updated_at 2026_07_30, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)