Summary

Check Point disclosed CVE-2026-93616 (CVSS 9.8), a directory traversal and file upload vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts on the Check Point Management Server and related products (Actively Exploited). Check Point confirms this vulnerability is being exploited in the wild and states it is aware of a handful of customers who have been attacked (sk1000171). CISA added CVE-2026-93616 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-22 with a remediation due date of 2026-09-25 and a forensic-triage requirement, corroborating the urgency independently of the vendor's own disclosure.

Affected Systems and/or Applications

Per sk1000171, the following products are affected:

• Security Management Server
• Multi-Domain Security Management Server
• Log Server
• Multi-Domain Log Server
• SmartEvent

Vulnerable versions:

• R82.20 (all)
• R82.10, Jumbo Hotfix Take 44 or lower
• R82, Jumbo Hotfix Take 126 or lower
• R81.20, Jumbo Hotfix Take 166 or lower
• R81.10, Jumbo Hotfix Take 190 or lower (End of Support)
• R80, R80.10, R80.20, R80.30, R80.40, R81 (all End of Support)

Not affected: Smart-1 Cloud, Check Point Firewall Appliances, Check Point Spark Firewall.

Technical Details

Vulnerability Mechanism

An unauthenticated attacker can combine a directory traversal flaw with the Management Server's file upload functionality to write and execute arbitrary scripts on the server (sk1000171). Check Point's own mitigation guidance is scoped to the management web service listening on TCP/19009, indicating that is the exposed component involved.

Observed Exploitation Path

Check Point states this vulnerability "is exploited in the Wild" and that it "is aware of a handful of customers who have been attacked". Check Point has not published a detailed attacker TTP timeline beyond the detection guidance in sk1000171's "Indication of Compromise" section, reproduced under Threat Hunting below.

Key Points

• CVSS 9.8, unauthenticated, remotely exploitable.
• Confirmed active exploitation in the wild against a handful of customers.
• Listed in CISA KEV as of 2026-09-22 with a due date of 2026-09-25 and forensic-triage flagged, under BOD 26-04.
• No FIRST EPSS score is available yet, consistent with how recently this CVE was published; this does not diminish the confirmed KEV listing and vendor-confirmed in-the-wild exploitation.
• No Tenable or Qualys scanner coverage could be confirmed or ruled out for this CVE through available tooling at assessment time (unknown/ambiguous); this does not indicate an absence of coverage.

Mitigation

Immediate Actions for Self-Hosted Instances

Limit Exposure

Restrict access to TCP/19009 to trusted IP addresses only, via Security Gateway/firewall configuration (sk1000171).

Patch/Upgrade

Apply the fix appropriate to the deployed version (sk1000171):

• R82.20: Security Hotfix (TAR download available)
• R82.10: Jumbo Hotfix Accumulator Take 45 or higher
• R82: Jumbo Hotfix Accumulator Take 127 or higher
• R81.20: Jumbo Hotfix Accumulator Take 170 or higher
• R81.10: Jumbo Hotfix Accumulator Take 192 or higher

A LivePatch is not available for this issue due to the nature of the fix; LivePatch Take 28/29 does not address it (sk1000171). Versions marked End of Support (R81.10 and below) have no fix path other than upgrade.

Threat Hunting

Check Point's "Indication of Compromise" section in sk1000171 provides two Expert-mode commands to run on Security Management, Multi-Domain Management, Log, Multi-Domain Log, and SmartEvent servers:

Command 1 — abnormally long usernames in login attempts (suggesting exploitation attempts):

grep -nHP "login\(loginRequest=LoginRequest\{authenticationInfo=AuthenticationInfoBase\{username='[^' ]{1001,}'" "$MDS_FWDIR"/log/cpm.elg*

If this returns results, and core dumps were generated at the same time, exploitation may have occurred.

Command 2 — directory traversal sequences in resource-file load errors:‍


grep -E "ERROR.*upgrade\.base\.ReflectionUtils.*Failed to load allResourceFiles map from" $MDS_FWDIR/log/cpm.elg*

If this returns results with paths containing ../ sequences, investigate for compromise.

Run both commands on every in-scope server (sk1000171).

Assume Breach if Unpatched

No customer-specific evidence of internet/exposure status or compromise during an exploitation window was obtained in this assessment, so this condition is not evidenced for any specific environment. Organizations that confirm a vulnerable Management Server, Log Server, or SmartEvent instance was reachable on TCP/19009 before patching should treat that instance as a credible compromise scenario and follow the threat-hunting guidance above.

What the Cyber Fusion Center is Doing

The CFC is monitoring the situation and analyzing the case to identify potential threat-hunting campaigns. This advisory will be updated if required.

IDs

• CVE: CVE-2026-93616
• CWE: CWE-22 (Path Traversal)
• Vendor Advisory: sk1000171
• CISA KEV: Listed 2026-09-22, due 2026-09-25
• Tenable: not yet published
• Qualys ID: 388806

References

• Check Point sk1000171: https://support.checkpoint.com/results/sk/sk1000171/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Security Advisory – Action Required: https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
• Qualys ID: https://www.qualys.com/vulnerability-detection-pipeline

‍