Check Point Patches Critical Management Server Zero-Day Exploited in In-The-Wild Attacks
Check Point has pushed out emergency hotfixes to resolve a critical security flaw tracked as CVE-2026-93616 affecting its central management ecosystem. The vulnerability is classified as a directory traversal and arbitrary file upload issue carrying a CVSS score of 9.8. It allows unauthenticated threat actors to remotely upload and execute arbitrary scripts on impacted systems through low-complexity attack chains. The flaw directly impacts central management infrastructure, which stores security policies, processes administrator modifications, and aggregates system logs across enterprise footprints. Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent components. Check Point confirmed that in-the-wild exploitation has already been observed against a small number of customers. The vendor rolled out the R82.20 Security Hotfix and incorporated fixes into the Jumbo Hotfix Accumulator for R82.10 (Take 45), R82 (Take 127), R81.20 (Take 170), and R81.10 (Take 192). Administrators relying solely on standard LivePatch updates should note that LivePatch does not resolve this flaw. For environments unable to immediately patch, Check Point recommends restricting network exposure by placing management servers behind firewalls and filtering TCP port 19009 access exclusively to trusted IP ranges. The vendor also advises configuring SmartConsole rules under Trusted Clients to enforce strict origin limits. CISA responded by cataloging CVE-2026-93616 in its Known Exploited Vulnerabilities list alongside CVE-2026-85102, an improper certificate validation vulnerability in Security Gateway and Spark appliances that is also facing active exploitation.
Commentary
Targeting the management plane is the ultimate jackpot for attackers because compromising the Check Point Management Server provides keys to the entire policy deployment pipeline and downstream enforcement gateways. With CVE-2026-93616 allowing unauthenticated arbitrary file uploads, an attacker can gain code execution on the management host and potentially pivot to all connected firewalls, modify security rules, or exfiltrate logs. Immediate priority must be given to applying the relevant Jumbo Hotfix Accumulator or the R82.20 hotfix. Because LivePatch is ineffective against this flaw, a full hotfix installation is required. Security teams should immediately verify that TCP port 19009 and SmartConsole management services are strictly sequestered onto dedicated, out-of-band management VLANs rather than exposed to untrusted segments or the public internet. Defenders should also review Check Point's published Indicators of Compromise (IoCs) across their Log Server and SmartEvent instances, while simultaneously checking audit logs for anomalous script execution, unexpected file writes, or failed administrator authentication anomalies.
The Quote to Remember
“This vulnerability is exploited in the Wild. Check Point is aware of a handful of customers who have been attacked,”
“Check Point disclosed the vulnerability and released fixes on September 9, 2026. At the time, we had no evidence of exploitation. We are now observing exploitation attempts against Check Point Spark customers globally.”