A Shortcut Check Point Didn’t Expect

This week’s CVE of The Week highlights a newly disclosed zero-day vulnerability in Check Point Software Technologies, a leading provider of cybersecurity solutions, after the vendor confirmed that the flaw was exploited in targeted attacks before a patch became available. Tracked as CVE-2026-93616, the vulnerability affects core management components within Check Point environments and has received a CVSS score of 9.8, placing it in the critical severity category.

Critical Flaw in Check Point Management Servers

According to Check Point, the flaw is a pre-authentication path traversal and file upload vulnerability affecting the Management web service. An unauthenticated attacker can exploit the flaw to upload and execute arbitrary scripts on vulnerable management systems without requiring valid credentials.

The vulnerability impacts several key products, including:

• Security Management Server
• Multi-Domain Security Management Server
• Log Server
• Multi-Domain Log Server
• SmartEvent

These systems serve as the centralized repository for security policies, administrative operations, and log collection across enterprise deployments. A successful compromise of such infrastructure could provide attackers with extensive control over an organization’s security environment.

Exploitation Observed Prior to Disclosure

Check Point reported that a limited number of customers were targeted as early as 23rd July 2026, well before the public release of security fixes. The company has acknowledged that several organizations were successfully attacked, although attribution details and post-exploitation activities have not been publicly disclosed.

Related Threat Activity: CVE-2026-85102

The disclosure of CVE-2026-93616 comes amid active exploitation of another critical Check Point vulnerability, CVE-2026-85102. This flaw affects the Security Gateway product and stems from improper validation of certificate data during VPN negotiation. Successful exploitation may allow an unauthenticated remote attacker to bypass authentication and achieve remote code execution. The vulnerability has also been assigned a CVSS score of 9.8.

While CVE-2026-93616 targets the management plane, CVE-2026-85102 focuses on VPN functionality exposed at the network perimeter. Check Point confirmed a wave of exploitation attempts beginning on September 12, 2026, primarily targeting Spark customers. Observed attacks originated through various anonymization infrastructure, including VPNs and proxies.

The simultaneous exploitation of both vulnerabilities highlights a broader trend in which threat actors increasingly target security appliances and management platforms as high-value entry points into enterprise networks.

Vendor Response and Mitigation

Check Point has released emergency hotfixes for CVE-2026-93616 and strongly recommends that all affected organizations deploy the available patches immediately. The fix is included in the latest Security Hotfix and Jumbo Hotfix releases, while existing LivePatch updates do not remediate this vulnerability. Organizations operating Internet-facing management servers should prioritize patching due to the confirmed in-the-wild exploitation of the flaw.

For environments where patching cannot be performed immediately, Check Point recommends restricting access to Management Servers behind a security gateway or firewall and limiting access to trusted administrative IP addresses only. Administrators should also review Trusted Clients configurations within the SmartConsole dashboard and remove any unnecessary management exposure.

In addition to patching, security teams should review the indicators of compromise (IoCs) published by Check Point in article sk1000171 and conduct retrospective log analysis to identify signs of unauthorized access or script execution. Organizations should also ensure that protections for CVE-2026-85102 have been applied, as both vulnerabilities are now included in the CISA Known Exploited Vulnerabilities catalog and are being actively targeted by threat actors.

For additional information about the CVEs, please visit:
https://www.bleepingcomputer.com/news/security/check-point-patches-management-server-zero-day-exploited-in-attacks/
https://www.bleepingcomputer.com/news/security/check-point-warns-of-hackers-exploiting-security-gateway-vpn-rce-flaw/
https://cvefeed.io/vuln/detail/CVE-2026-93616
https://support.checkpoint.com/results/sk/sk1000171

Do you want to be protected from attacks like the above? See our defensive services here: Managed Security – White Hat IT Security