Loading story…
Check Point has disclosed CVE-2026-93616, a critical CVSS 9.8 path-traversal and unsafe file-upload vulnerability affecting its Security Management infrastructure. An unauthenticated remote attacker can upload and execute arbitrary scripts and load arbitrary Java classes, enabling remote code execution. Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent.
The company confirmed that the flaw was exploited in a small number of targeted attacks before fixes were available, though it has not identified the threat actor, victims, or objectives. Organizations should immediately deploy the R82.20 Security Hotfix or applicable fixed Jumbo Hotfix Accumulator, review Check Point-provided indicators and relevant logs/core dumps, and restrict management access—including TCP/19009—to trusted systems; where patching is delayed, SmartConsole Trusted Clients and firewall rules should limit access to approved IP addresses.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Check Point updated its CVE-2026-93616 advisory with indicators and guidance for investigating potentially affected management, logging, and SmartEvent servers, including cpm.elg logs and FWM or MDS core dumps.
Check Point observed a handful of targeted customer attacks exploiting CVE-2026-93616 before a security update was available. The activity was not publicly attributed, and affected organizations and attacker objectives were not disclosed.
Check Point disclosed CVE-2026-93616, a critical path-traversal and unsafe file-upload flaw that allows unauthenticated attackers to upload and execute arbitrary scripts on vulnerable Security Management infrastructure. The company released an R82.20 Security Hotfix and fixed Jumbo Hotfix Accumulator versions, and advised affected customers to restrict management access while remediation is pending.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point released fixes for **CVE-2026-18574**, a critical authentication-bypass flaw in **Security Management Server** and **Multi-Domain Security Management Server (MDS)** that can let an unauthenticated remote attacker with network access to management services execute arbitrary commands. The vulnerability carries a **CVSS 4.0 score of 9.3** and is classified as **`CWE-288`**, with impact that can extend to full compromise of the security management environment. Check Point said it discovered the issue internally and reported no evidence of active exploitation, while noting that **Smart-1 Cloud** customers are already protected. Supported affected versions include **R81.20, R82, and R82.10**, with older affected releases from **R80 through R81.10** now end-of-support; fixes were issued through **Jumbo Hotfix Accumulator** updates. The company urged customers to apply patches, restrict **Trusted Clients**, limit management access to trusted administrator systems, avoid exposing management interfaces to untrusted networks or the public internet, and monitor for unauthorized activity.
Aug 8, 2026
Check Point released fixes for **CVE-2026-91843**, a critical (CVSS 9.8) stack-based buffer overflow in the login process of its Security Management and Log Server products. A remote, unauthenticated attacker can reportedly submit an excessively long username to execute arbitrary code with root privileges before authentication. Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, and Multi-Domain Log Server across R81.20, R82, R82.10, R82.20, and certain older releases; **Smart-1 Cloud is not affected**. Administrators should urgently deploy Check Point’s LivePatch or applicable offline updates, verify remediation on every management and logging server, and review failed-login records for oversized-username attempts. Organizations should also restrict SmartConsole Trusted Clients until patching is validated. Check Point has not reported active exploitation or disclosed a public exploit chain; releases earlier than R81.20 are end of support and will not receive patches, requiring an upgrade or replacement strategy.
Sep 18, 2026
Check Point disclosed **`CVE-2026-16232`**, a high-severity SmartConsole authentication bypass affecting **Security Management**, **Multi-Domain Management**, **Firewall**, and **Multi-Domain Log Server** products across multiple versions. The flaw, rated **CVSS 9.3**, allows attackers to bypass SmartConsole login using an application token, and Check Point said it has already been exploited against a small number of customers with specific exposed configurations. Check Point released fixes for `CVE-2026-16232` along with related flaws **`CVE-2026-62144`** and **`CVE-2026-62145`**, while the Canadian Centre for Cyber Security issued advisory **AV26-735** urging organizations to review the vendor guidance and apply mitigations. The highest risk is for management interfaces exposed directly to the internet without IP restrictions, and defenders were advised to install the available jumbo hotfix, restrict trusted GUI clients by IP address, and place management access behind a firewall until patching is complete.
Aug 15, 2026