Check Point has officially confirmed that CVE-2026-93616, a zero-day vulnerability in its Security Management Server, was exploited in targeted attacks as far back as July 23, 2026. The flaw enables unauthenticated attackers—if they can reach the management web service—to upload arbitrary scripts and execute them without logging in. A security patch for this issue was released on September 22.
This vulnerability is a path-traversal bug in the web service component of the management infrastructure. It fails to constrain requests to valid file and folder paths, enabling attackers to move outside the intended directory boundaries, upload malicious scripts, and load arbitrary Java classes. The flaw carries an extremely high severity of 9.8 out of 10 on the CVSS scale.
Affected Products & Versions
The issue impacts multiple core components of Check Point’s management ecosystem, including:
- Security Management Server and Multi-Domain Management Server
- Log Server and Multi-Domain Log Server
- SmartEvent server instances
Versions affected span across several release lines: R82.20 without recent jumbo hotfixes; R82.10 with Jumbo Hotfix Take 44 or earlier; R82 with Jumbo Hotfix Take 126 or earlier; R81.20 with Jumbo Take 166 or earlier; R81.10 with Jumbo Take 190 or earlier (now end-of-support); and all EoS (end-of-support) branches in R80/R81. LivePatch Takes 28/29 do not address this vulnerability.
Other Related Flaws & Attack Activity
In parallel, another serious issue, CVE-2026-85102, affecting Spark firewalls and Security Gateway appliances, has also been under attack. This flaw allows unauthenticated remote code execution during VPN certificate negotiation, particularly when Site-to-Site or Remote Access VPN is in use. A patch for that issue has been available since September 9.
CVE-2026-85103, a certificate decoding heap-overflow bug (during ASN.1 parsing) with similar pre-authentication and code execution risks, is also addressed by the hotfixes.
Recommended Actions for Administrators
- Check current version and Jumbo Hotfix (or LivePatch) take against the published affected list. Servers falling within those ranges should be patched immediately using support article SK1000171.
- Review logs for indicators such as abnormally long usernames (over 1,000 characters), ReflectionUtils errors involving “../” paths, and synchronized core dumps or crash logs pointing to unauthorized script or Java class loading.
- Restrict network access to the vulnerable web service port (TCP/19009). Limit exposure to trusted IPs where full patching is not yet deployed.
- If patching after exposure has occurred, assume potential compromise. Assess integrity of policies, check for persistence, verify logs and system state.
The fix for CVE-2026-85102 (Spark / VPN certificate flaw) can be found in SK1000117; administrators who applied it are considered protected against this threat.
The broader set of jumbo or hotfix builds required to remediate CVE-2026-93616 are detailed in SK1000171. Servers using LivePatch only (Takes 28 and 29) remain vulnerable.
This vulnerability has been confirmed by Check Point to be under active exploitation, as part of targeted campaigns. So far, the victims, attackers, and full scope of what was accessed remain undisclosed.
Operators managing Check Point environments should regard this as high-urgency. Any delay in patching or mitigating this flaw risks exposure of management infrastructure, potentially undermining the foundation of policy control, logging, and security enforcement.
Why this matters:The Security Management and related servers are the nerve center of perimeter defense systems; when compromised, attackers could alter firewall rules, erase logs, or push malicious configurations—threats far more severe than just a single gateway bug. Simply patching won’t repair any damage already done. It’s essential to verify integrity, narrowing which versions need fixes and immediately locking down network access. This zero-day isn’t just another vulnerability—it threatens the trust model of many enterprise environments. Watch how Check Point and the security community tighten notices around third-party audits, incident tracking, and whether the company will disclose the attacker’s identity or the full breadth of the breach.
