Check Point Patches Critical Management Server Zero-Day Exploited in In-The-Wild Attacks
Check Point has pushed out emergency hotfixes to resolve a critical security flaw tracked as CVE-2026-93616 affecting its central management ecosystem. The vulnerability is classified as a directory traversal and arbitrary file upload issue carrying a CVSS score of 9.8. It allows unauthenticated threat actors to remotely upload and execute arbitrary scripts on impacted systems through low-complexity attack chains. The flaw directly impacts central management infrastructure, which stores security policies, processes administrator modifications, and aggregates system logs across enterprise footprints. Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent components. Check Point confirmed that in-the-wild exploitation has already been observed against a small number of customers. The vendor rolled out the R82.20 Security Hotfix and incorporated fixes into the Jumbo Hotfix Accumulator for R82.10 (Take 45), R82 (Take 127), R81.20 (Take 170), and R81.10 (Take 192). Administrators relying solely on standard LivePatch updates should note that LivePatch does not resolve this flaw. For environments unable to immediately patch, Check Point recommends restricting network exposure by placing management servers behind firewalls and filtering TCP port 19009 access exclusively to trusted IP ranges. The vendor also advises configuring SmartConsole rules under Trusted Clients to enforce strict origin limits. CISA responded by cataloging CVE-2026-93616 in its Known Exploited Vulnerabilities list alongside CVE-2026-85102, an improper certificate validation vulnerability in Security Gateway and Spark appliances that is also facing active exploitation.
Read more about Check Point Patches Critical Management Server Zero-Day Exploited in In-The-Wild Attacks