CVE-2026-93616

What is Check Point Security Management?

Check Point Security Management Server is the brain of a Check Point deployment. Administrators do not configure gateways directly; they define policy in SmartConsole against the management server, which compiles it and pushes it to every enforcement point in the estate. The same family covers Multi-Domain Security Management for service providers and large multi-tenant environments, Log Server and Multi-Domain Log Server for collecting firewall logs, and SmartEvent for correlation and reporting.

That makes the management server a higher-value target than any single firewall. It holds the full security policy, the object database describing the network, administrator credentials and certificates, the SIC trust material that gateways use to authenticate it, and the log record of what the perimeter has seen. An attacker with code execution there can change policy across every gateway at once and edit or delete the logs that would show they did.

Overview

CVE-2026-93616 is a pre-authentication path traversal in the Check Point Management web service, reachable on TCP/19009. It combines directory traversal with unsafe file-upload handling: by manipulating a path, an unauthenticated attacker can get the service to execute a script from an arbitrary location on disk and load an arbitrary Java class. The result is remote code execution on the management server with no credentials at all. The CVE carries a CVSS 3.1 base score of 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

This was a zero-day. Check Point Research observed the first pinpointed attacks on 2026-07-23, roughly two months before the fix and the advisory appeared on 2026-09-22. CISA added the CVE to the Known Exploited Vulnerabilities catalog the same day it became public, with a remediation deadline of 2026-09-25.

One detail deserves emphasis for anyone who patched the Check Point VPN flaws earlier this month: Check Point states that LivePatch versions 28 and 29 do not address this vulnerability, and the Jumbo Hotfix takes that fixed CVE-2026-85102 are themselves vulnerable to CVE-2026-93616. A gateway estate that is current on the September VPN fixes still needs a separate management server update.

Affected Versions

The same versions apply to Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent, which all run the affected management web service. Check Point states that Smart-1 Cloud, Check Point Firewall Appliances and Spark Firewall are not affected.

Technical Details

The weakness is CWE-22, improper limitation of a pathname to a restricted directory. The management web service accepts a value that ends up being used as a file path without confining it to the directory it was supposed to stay inside. Supplying traversal sequences such as ../ walks the path out of the intended directory and points it anywhere on the filesystem the service can reach. Path traversal on its own usually yields file read or file write; here it is paired with the service's ability to execute a script at a given path and to load a Java class by name, which turns a path problem directly into code execution inside the management process.

The attack profile is as bad as the CVSS vector suggests: no authentication, no user interaction, low complexity, and no need to chain a second vulnerability. The single constraint is reachability of TCP/19009, the management web service port. Management servers are not supposed to be internet-facing, and an organization that has kept TCP/19009 confined to an administrative network has meaningfully reduced its exposure, but the port is frequently reachable from broad internal ranges, from site-to-site VPN peers, and from managed service provider networks.

Check Point's indicators point at the parsing path: the vendor tells customers to look in cpm.elg for login attempts carrying unusually long username fields, for ReflectionUtils errors reporting a failure to load an allResourceFiles map, and for traversal sequences appearing in error messages or core dumps.

Discovery

Check Point Research identified the vulnerability while investigating attacks against its own customers rather than through proactive testing, which is what the 2026-07-23 exploitation date implies. No external researcher has been credited and no proof-of-concept has been published. Check Point acted as CNA and published the CVE record alongside sk1000171 and the hotfix on 2026-09-22.

Exploitation Context

Check Point describes the activity as "a handful of pinpointed attacks" beginning 2026-07-23 and affecting a small number of identified customers. The vendor has declined to publish the attackers' identity, objectives, payloads, or the sectors targeted. Independent reporting notes the obvious caveat: a count of confirmed victims is a floor, not a ceiling, particularly for a two-month zero-day window against a device whose own logs the attacker can edit.

No threat actor has been named, no exposure figure from Shadowserver or Censys has been published for TCP/19009, and no public exploit code exists at the time of writing. CISA does not flag the CVE as used in ransomware campaigns. The targeting pattern, deliberate and narrow rather than opportunistic, is more consistent with espionage than with commodity crime, but Check Point has not made that assessment publicly and it should be treated as inference.

Remediation

1. Install the fix for your branch: the R82.20 Security Hotfix, or Jumbo Hotfix Take 45 on R82.10, Take 127 on R82, Take 170 on R81.20, or Take 192 on R81.10.
2. Do not rely on LivePatch for this CVE. Check Point states that LivePatch 28 and 29 do not address CVE-2026-93616, so the hotfix must be installed explicitly even on estates where LivePatch handled the September VPN flaws.
3. Restrict TCP/19009 to trusted management addresses at the network layer, and separately set Trusted Clients in SmartConsole under Manage and Settings, Permissions and Administrators, Trusted Clients so the server itself only accepts verified internal networks. Do both; the SmartConsole setting is not a substitute for a firewall rule.
4. Confirm no management server, log server, or SmartEvent instance is reachable from the internet, from a site-to-site VPN peer, or from a third-party maintenance tunnel.
5. Hunt back to 2026-07-23, not just to the advisory date. In cpm.elg, look for login attempts with abnormally long username fields, for ReflectionUtils errors mentioning a failed allResourceFiles map load, and for ../ sequences in error text. Review core dumps generated on the management server over the same period.
6. If compromise is suspected, treat the policy database and trust material as attacker-known. Rotate administrator credentials and certificates, review the policy and object database against a known-good revision, and check for administrator accounts or automation API keys you did not create. Compare logs against an off-box copy, since an attacker with code execution on a log server can alter what it retained.
7. Upgrade any R80 series or R81 deployment. Those versions are past end of support and receive no hotfix.
8. Federal civilian agencies were required to remediate by 2026-09-25 under BOD 26-04. Given a confirmed two-month zero-day window, hunting for prior compromise matters as much as installing the patch.