Last week we wrote about the 47.4% of IT teams flying blind on Shadow AI. This week, the tools those teams are *not* flying blind on (legitimate admin consoles, automation platforms, and self-hosted developer tools) are getting hit with pre-authentication exploits at a pace that should reset every CISO’s priorities.

On July 23, Check Point disclosed CVE-2026-16232, a CVSS 9.3 authentication bypass in SmartConsole, the admin panel used to manage Check Point firewalls and Security Gateways. It is being exploited in the wild right now. There is no patch you can install; there is a fix you have to pull from Check Point’s portal and apply manually. If your firewall’s management interface is reachable from the public internet, and a surprising number still are, the bypass is the only thing standing between an attacker and full administrative control of your perimeter.

This is not a one-off. It is the pattern of the month.

The Pattern: Pre-Auth Holes in Admin Panels

In the last ten days, I count at least six high-severity, pre-authentication or low-privilege vulnerabilities in internet-reachable admin interfaces:

• Check Point SmartConsole (CVE-2026-16232): CVSS 9.3, authentication bypass, actively exploited. Full admin on the firewall.
• vBulletin 6.x: Public exploit code released on July 27. SSD Secure Disclosure describes a single unauthenticated HTTP request reaching PHP’s eval() and executing code on the forum server. No account, no admin, no user interaction.
• n8n 2.31.x and 2.32.0: Expression-sandbox escape (CVE-2026-27577 follow-on). An authenticated workflow editor can run OS commands as the n8n process. If you expose n8n to the internet so remote contractors can edit workflows, you have given them code execution on your automation host.
• Windmill: Filename parameter flaw, exploited in the wild per VulnCheck. Read arbitrary server files without authentication. Windmill is the kind of self-hosted internal tool nobody remembers to put behind the VPN.
• PTC Windchill and FlexPLM: Cl0p ransomware affiliates are chaining a pre-auth WSDL information disclosure with a server-side login flaw for full unauthenticated RCE on internet-exposed product-lifecycle-management servers. These are the systems that hold the CAD files and manufacturing IP for a lot of mid-market industrial companies.
• Fastjson 1.x (CVE-2026-16723): CVSS 9.0 in Alibaba’s JSON parser, actively exploited in Spring Boot applications. One crafted JSON request, no auth, code execution.

Six different vendors. Six different industries. The same shape every time: a web-accessible admin surface, a flaw that does not require valid credentials, and exploitation that lands within days of disclosure.

Why the Management Console Became the Perimeter

Ten years ago, the management console was a thing only the sysadmin touched, from a workstation on the corporate LAN, over a jump host. That world is gone.

A few forces pushed the admin panel onto the public internet, and most of them were reasonable at the time:

• The automation boom. Every SaaS platform now exposes a workflow editor, a connector manager, a tenant admin. n8n, Windmill, NodeBB, and a hundred smaller tools default to being reachable from anywhere so remote staff and contractors can do their jobs.
• Vendor defaults. Check Point SmartConsole, PTC Windchill, and several industrial control panels ship with the management interface on the same network plane as the service. Splitting them requires someone to know to do it.
• “Just for the migration.” We have all done it. A temporary public IP on a management port for a weekend cutover that never gets reversed. Three years later it is still there and the original engineer has moved on.
• Shadow AI, from a different angle. Last week’s piece talked about the AI tools employees are using. The other half is the AI agents IT teams are deploying without a security review — Copilot Studio bots, ChatGPT Workspace agents, internal LangChain apps. Each one is a management console. Each one was stood up fast and is reachable by design.

The CrowdStrike 2026 Global Threat Report pegs roughly 79% of intrusions as malware-free — meaning the attacker uses valid credentials or exploits a legitimate interface rather than dropping a payload. That statistic understates the current moment. The legitimate interface now often ships with a pre-auth hole.

What the Data Says About the Backlog

Two numbers from the last two weeks should reshape your patch-priority list:

Microsoft’s July 2026 Patch Tuesday shipped fixes for 570 vulnerabilities — the largest monthly release on record, per Krebs on Security. Of those, 11 were critical RCEs in components most enterprises do not think about: Hyper-V, Remote Desktop Gateway, Windows Routing and Remote Access Service. The defenders’ queue is longer than the attackers’.

Verizon’s 2026 Data Breach Investigations Report (still the cleanest cross-industry baseline) found that exploitation of vulnerabilities tripled as an initial-access pattern between the 2024 and 2026 editions, surpassing stolen credentials for the first time in the report’s history. The methodology shift matches what the news cycle is showing: it is easier for attackers to find a fresh CVE than to phish a credential.

You do not have to patch 570 CVEs. You have to patch the ones in things that are reachable from the internet. The hard part is the second clause.

Five Things to Do This Week

1. Inventory what is listening on a public IP. Run nmap -p- against your external range, or pull a Shodan report for your CIDRs. Anything with a web UI that is not behind a VPN or zero-trust gateway is your to-do list. Be ruthless. If a contractor needs it, give them a Tailscale/Cloudflare Tunnel path, not a public port.
2. Block management interfaces at the firewall, not just authenticate them. Check Point, PTC, VMware vCenter, Cisco Prime, all of them. The admin UI should be on a management VLAN reachable only from a bastion. The internet should not be in the ACL for it.
3. Force manual emergency patching for actively-exploited CVEs regardless of your normal patch cycle. CVE-2026-16232 is the textbook case. Your two-week patch SLA is a week too slow when exploitation is in the news. Subscribe to CISA’s Known Exploited Vulnerabilities catalog and treat every KEV addition as a 72-hour item.
4. Audit your n8n, Windmill, NodeBB, and similar self-hosted instances. If you are running any of them, check the version. Apply the July fixes. And ask yourself whether the workflow editor really needs to be reachable from the public internet, or whether a VPN split-tunnel would do.
5. Run an external attack-surface scan monthly, not annually. The platforms that find this (Tenable ASM, CrowdStrike Falcon Surface, runZero, the free Shodan/Censys queries) all surface the same thing in different UIs: the forgotten management port. The value is the monthly repetition. You are looking for change, not a clean baseline.

Closing

The pattern of the last month is not “attackers got smarter.” It is that the surface area grew faster than the controls did, and the gap is showing up in the news once a week now. The fix is not a new product. It is the boring work of shrinking what the public internet can reach, and treating actively-exploited CVEs as the emergency they are. Your firewall’s admin console should not be one Shodan query away from a stranger. In 2026, it usually is.