CVE-2026-93616: Check Point Management Server Zero-Day Exploited in Targeted Attacks

Check Point has released emergency security updates for a critical zero-day vulnerability affecting its Security Management infrastructure after confirming exploitation in targeted attacks. Tracked as CVE-2026-93616 and rated 9.8 on the CVSS scale, the flaw enables an unauthenticated attacker with network access to the vulnerable management service to upload and execute arbitrary scripts.

The vulnerability combines path traversal with unsafe file-upload behavior in the Check Point Management web service. By escaping intended directory restrictions, an attacker can place malicious content in arbitrary locations and subsequently execute scripts or load an arbitrary Java class without authenticating to the management server.

The security issue is especially significant because Check Point management infrastructure sits at the center of enterprise firewall administration, security policy management, administrator access, and logging. Compromise of such a system can provide attackers with a powerful foothold inside an organization’s security architecture.

Check Point Research confirmed that the vulnerability had already been exploited before public disclosure. The company observed a handful of highly targeted attacks on July 23, 2026, almost two months before patches became publicly available on September 22.

Contact Sales

CVE-2026-93616 analysis

The flaw is classified as a pre-authentication path traversal vulnerability in the Check Point Management web service. Improper restriction of filesystem paths allows attacker-controlled requests to reach locations outside the directory the application is supposed to access. Combined with file-upload functionality, this makes it possible to place attacker-controlled files on the server and execute them.

The most important details for CVE-2026-93616 are that exploitation does not require administrator credentials, an existing user account, or victim interaction. An attacker must, however, have network connectivity to the vulnerable management service.

Check Point assigns the vulnerability a CVSS score of 9.8, reflecting a network-accessible attack vector, low attack complexity, no required privileges, and no required user interaction. Successful exploitation can have a high impact on confidentiality, integrity, and availability.

The attack path begins when a threat actor sends a specially crafted unauthenticated request to the affected management web service. Path traversal enables the request to escape the application’s intended filesystem boundaries, while the file-upload weakness allows attacker-controlled content to be written to an arbitrary path.

Check Point further states that the vulnerability can be used to execute a script from an arbitrary location and load an arbitrary Java class. This moves the issue beyond basic file disclosure or unauthorized file creation and into remote code execution territory.

CVE-2026-93616 affects Check Point Security Management Server as well as management-related products including Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Check Point has also clarified that standalone appliances combining gateway and management functionality require remediation because the management component remains exposed to the flaw.

Affected software includes:

• R82.20
• R82.10 with Jumbo Hotfix Take 44 or earlier
• R82 with Jumbo Hotfix Take 126 or earlier
• R81.20 with Jumbo Hotfix Take 166 or earlier
• R81.10 with Jumbo Hotfix Take 190 or earlier
• R81
• R80.40
• R80.30
• R80.20
• R80.10
• R80

The R81.10 and older branches listed above are already end-of-support releases and should be migrated to supported software rather than retained as a long-term remediation strategy.

Check Point Smart-1 Cloud is already protected because the vendor has applied the required fix. Check Point has also stated that standalone Quantum Force and Spark firewall products are not directly affected by this particular vulnerability unless the affected management functionality is present on the same system.

The vulnerability is particularly dangerous because Security Management Servers can contain or control highly sensitive operational information. These systems coordinate security policies, administrator changes, firewall configuration, and enterprise logging. An attacker capable of executing arbitrary code on the management infrastructure could potentially use that access to support further intrusion activity.

Potential post-exploitation actions could include modifying security policy, tampering with management data, obtaining sensitive configuration information, establishing persistence, manipulating logs, or attempting to pivot toward systems managed by the compromised server. These are possible consequences of server compromise; Check Point has not publicly disclosed what the attackers actually did after exploiting the zero-day.

The observed exploitation remains highly targeted. Check Point says only a handful of customers were attacked and describes the activity as “pinpointed.” The vendor has not named the affected organizations, identified the threat actor responsible, or disclosed the attackers’ objectives.

The timeline is particularly important. Check Point observed the attacks on July 23, while the vulnerability and patches were publicly disclosed on September 22. Organizations running vulnerable management infrastructure during that period therefore need to consider retrospective investigation rather than treating patch installation alone as sufficient proof that their environments were not compromised.

A vendor-validated public CVE-2026-93616 PoC has not been confirmed in the primary advisory or the two requested reports. However, the absence of publicly documented exploit code does not reduce the immediate risk because Check Point has already confirmed successful real-world exploitation.

Check Point has published hunting guidance and CVE-2026-93616 IOCs through support advisory sk1000171 and recommends that customers use those indicators to investigate systems that were exposed before patching.

Because the vulnerability operates through the Management web service, security teams should also focus on network connections to the management plane. Check Point specifically recommends restricting TCP port 19009 so it can be reached only from trusted IP addresses.

Defenders should investigate unexpected unauthenticated connections to that service, suspicious filesystem activity, newly created scripts or Java classes, unusual child processes spawned by management services, and unexplained changes to management configuration.

The vulnerability should not be confused with CVE-2026-85102, another actively targeted Check Point issue disclosed in the same security advisory. CVE-2026-85102 affects VPN certificate handling on Security Gateways and Spark appliances, while CVE-2026-93616 specifically targets management infrastructure through the vulnerable web service.

CVE-2026-93616 Mitigation

Check Point recommends installing the newly released security fixes immediately. Unlike several recent Check Point vulnerabilities, this issue is not fixed by LivePatch Take 28 or Take 29, so administrators should verify that the dedicated security update or the required Jumbo Hotfix has actually been installed.

The fixed releases are:

• R82.20: Security Hot Fix Take 1
• R82.10: Jumbo Hotfix Take 45
• R82: Jumbo Hotfix Take 127
• R81.20: Jumbo Hotfix Take 170
• R81.10: Jumbo Hotfix Take 192

Check Point’s release documentation confirms that R82 Take 127 and R81.20 Take 170 include the fix for the directory traversal and arbitrary script-execution vulnerability.

Organizations operating unsupported R80 or R81 branches should upgrade to a supported release rather than relying on outdated software for critical security management infrastructure.

The primary CVE-2026-93616 mitigation is patching every affected management, log, Multi-Domain, and SmartEvent system. Administrators should inventory all management components rather than checking only the primary Security Management Server.

For environments where an update cannot be installed immediately, Check Point recommends reducing network exposure by putting management systems behind a firewall and restricting trusted clients to explicitly approved IP addresses.

Within SmartConsole, administrators can review the relevant configuration under:

Manage & Settings → Permissions & Administrators → Trusted Clients

Access to TCP/19009 should be restricted to authorized management networks and systems. Direct internet exposure of the management plane should be avoided.

CVE-2026-93616 detection should begin with determining which management servers were vulnerable and accessible on or before July 23, 2026. Any affected system exposed to untrusted networks during the period between the first known attacks and patch installation deserves additional investigation.

To Detect CVE-2026-93616 exploitation or related post-compromise activity, defenders should review:

• Connections to TCP/19009 from unknown or unauthorized IP addresses
• Unusual requests reaching the Check Point Management web service
• Directory traversal patterns in management-service requests or logs
• Unexpected files written outside normal application directories
• Newly created or modified scripts
• Unexpected Java class files or Java class-loading activity
• Suspicious child processes launched by Check Point management services
• Unexplained administrative or configuration changes
• Unexpected changes to security policies
• New accounts or altered administrator permissions
• Suspicious outbound network connections from management servers
• Attempts to modify or remove audit and security logs
• Activity on managed gateways that follows suspicious management-server access

These behaviors should be treated as investigation signals rather than unique exploit signatures. Check Point’s latest sk1000171 advisory remains the authoritative source for vendor-provided hunting instructions and indicators.

Organizations should also preserve logs outside the management server itself. If arbitrary script execution occurred, an attacker may have had enough control to alter local evidence. Firewall telemetry, SIEM records, NetFlow, DNS logs, authentication systems, and external management logs can therefore provide valuable independent evidence.

Patching an affected server prevents future exploitation through the vulnerable code path but does not establish whether the system was compromised before the fix was installed. Organizations exposed during the zero-day window should perform retrospective threat hunting and validate any administrative actions recorded since at least July 23.

If evidence of compromise is discovered, incident responders should determine whether security policies, credentials, certificates, administrator accounts, or other sensitive management data were accessed or modified. Potentially exposed authentication material should be rotated, and managed gateways should be reviewed for changes originating from the compromised management infrastructure.

Given the combination of unauthenticated access, low attack complexity, arbitrary script execution, and confirmed exploitation before disclosure, vulnerable management systems should be treated as an immediate remediation priority.