Critical Check Point Path Traversal Vulnerability Exposes Management Tier

Emergency updates have been issued for a critical Check Point path traversal vulnerability tracked as CVE-2026-93616. The flaw allows unauthenticated remote attackers to write arbitrary files to the filesystem and achieve remote code execution on any Check Point Security Management Server exposed over the network. Given the central role these appliances play in controlling enterprise network perimeters, immediate containment is required.

Technical Mechanics of CVE-2026-93616

The underlying weakness is a classic Directory Traversal flaw (CWE-22) located in the HTTP management interfaces of Check Point’s central management software. By sending crafted, unauthenticated HTTP requests containing path traversal sequences (such as ../), a remote attacker can bypass file upload restrictions and write arbitrary scripts to executable paths on the host operating system.

Because the underlying web services run with elevated privileges, writing a script to a directory monitored by an execution engine—or directly overwriting CGI scripts and system hooks—grants the attacker full, unauthenticated Remote Code Execution (RCE). The CVSS 3.1 score sits at a maximum-severity 9.8, defined by its vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack requires low technical complexity, no privileges, and zero user interaction.

Impact on Central Management Infrastructure

Security Management Servers, Multi-Domain Security Management Servers, Log Servers, Multi-Domain Log Servers, and SmartEvent platforms running versions R80 through R82.20 are affected.

Compromising a Check Point Security Management Server is a high-impact scenario. Central management appliances store the policy definitions, VPN configurations, and Secure Internal Communication (SIC) trust certificates for every connected security gateway across an organization. An attacker who gains root or execution-level access to the management tier can:

• Extract SIC keys and authenticate downstream to edge firewalls.
• Modify gateway security policies to open remote access or disable inspection engines.
• Harvest administrative credentials and API keys stored on the platform.
• Intercept, alter, or delete security log streams originating from SmartEvent and dedicated Log Servers.

While current threat metrics reflect an EPSS score of 2.4% (placing it in the 83.5th percentile of all tracked vulnerabilities), pre-authentication RCE vulnerabilities in edge-adjacent management systems are primary targets for automated scanning and initial access brokers. Organizations that leave management portals directly exposed to the internet face an immediate threat of exploitation.

Remediation and Triage Requirements

Organizations running affected Check Point management software must take immediate mitigation steps:

1. Apply Hotfixes: Install the hotfix published under Check Point Support Knowledgebase article SK1000171. Ensure systems are updated across all R80.x, R81.x, and R82.x deployment tiers.
2. Restrict Interface Exposure: Web management and SmartConsole access interfaces must be immediately removed from direct internet access. Restrict exposure strictly to internal, isolated management VLANs accessible only via secure jump boxes or dedicated administrative VPNs.
3. Forensic Triage: Examine web server access logs and system audit logs for anomalous HTTP POST/GET requests containing traversal patterns (..%2f, ../, %5c..) targeted at management web paths. Inspect temporary directories (such as /tmp or web roots) for unexpected executable files or recently modified scripts.