Check Point Patches Zero-Day Flaw Exploited in Management Server Attacks

Check Point Software has released emergency hotfixes for CVE-2026-93616, a critical Check Point Security Management Server vulnerability that threat actors have been actively exploiting in targeted attacks since at least July 23. The flaw allows unauthenticated remote attackers to upload and execute arbitrary scripts on central security management servers without needing valid login credentials. Because these servers dictate firewall policies and collect audit logs across entire enterprise networks, compromising one grants attackers near-total control over an organization’s perimeter security posture.

Check Point released updates addressing the issue on September 22, confirming that a small number of customers were targeted in the wild prior to the patch becoming available.

Mechanics of the CVE-2026-93616 Path Traversal Vulnerability

The security flaw is rooted in a path traversal weakness (CWE-22) within the web service component of Check Point’s management architecture. The web service fails to sanitize file and folder directory inputs in incoming requests, allowing an attacker to navigate outside the intended web root directory. An unauthenticated remote threat actor can exploit this oversight to upload executable scripts to arbitrary file paths on the server and immediately invoke them.

The vulnerability carries a maximum-severity CVSS v3.1 score of 9.8, defined by the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. In practical defender terms, this indicates that the flaw is network-accessible (AV:N), requires low attack complexity (AC:L), needs zero prior administrative privileges (PR:N), and demands no user interaction (UI:N), while delivering complete impact to confidentiality, integrity, and availability.

The blast radius extends across Check Point’s central management infrastructure, affecting the standard Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent correlation units. A compromised management server allows an adversary to push modified policy objects to managed security gateways, disable monitoring, extract stored secrets, or pivot deeper into internal network segments that trust the management appliance.

Escalating Pressure on Check Point Network Infrastructure

The disclosure of CVE-2026-93616 arrives during a period of sustained adversary focus on network appliances and gateway platforms. In parallel with the management server zero-day, Check Point warned that threat actors have been actively attempting to exploit CVE-2026-85102 since September 12. That flaw—a code execution vulnerability in how gateways handle certificates during VPN handshake setup—was patched on September 9, but attackers are actively scanning for unpatched Spark firewalls (Check Point’s small-business line) and enterprise Security Gateways.

These active VPN attack attempts originate from anonymizing infrastructure, including commercial VPN providers and proxies, using suspicious certificate subjects during Mobile Access login sequences.

This activity reflects a broader, multi-month pattern targeting Check Point environments. In recent months, threat actors have targeted multiple zero-days and high-severity flaws across the ecosystem:

• CVE-2026-16232: An authentication bypass in the login process for Security Management Servers and Security Gateways allowing code execution with root privileges.
• CVE-2026-50751: An authentication bypass zero-day exploited since June by Qilin ransomware affiliates.
• CVE-2024-24919: An older Quantum Security Gateway flaw previously weaponized by ransomware operators, including NailaoLocker affiliates.

When network gateways and management control planes suffer back-to-back zero-day exploitation, security teams must treat management appliances with the same defensive urgency as edge-facing firewalls.

Detection and Remediation Plan

Because applying a patch does not reveal whether a system was compromised before the fix was deployed, administrators must combine patching with targeted threat hunting.

1. Apply Emergency Hotfixes Immediately

Deploy the appropriate updates documented in Check Point support article sk1000171. Affected versions include R82.20, R82.10, R82, R81.20, and earlier builds.

• Note that LivePatch Take 28 (or Take 29 on R82.20), issued on September 16 for a separate issue (CVE-2026-91843), does not protect against CVE-2026-93616. Systems updated only to that level remain vulnerable.

2. Restrict Management Access (Temporary Mitigation)

If an emergency hotfix cannot be applied immediately, isolate the server’s web management interface from untrusted networks. Within the SmartConsole dashboard, enforce strict IP limits by navigating to: Manage & Settings > Permissions & Administrators > Trusted Clients Restrict access strictly to explicit, trusted administrator workstations.

3. Threat Hunting and Incident Investigation

• Audit the server filesystem for unexpected script files uploaded to web-accessible or system directories.
• Check system logs against indicators of compromise listed in support article sk1000171.
• For environments running VPN gateways affected by CVE-2026-85102, inspect audit and login logs for unusual certificate-based Mobile Access logins and examine post-login user activity for unauthorized internal port scanning.
• Look for “Administrator failed to log in: Username too long” events in Audit and Admin login logs, which indicate exploitation attempts associated with related login bypass flaws like CVE-2026-16232.