Actively Exploited Check Point Management Server Zero-Day Enables Unauthenticated RCE
Active Exploitation · 15 sources · Updated 1mo ago · First seen Sep 22, 2026
Check Point has disclosed CVE-2026-93616, a critical CVSS 9.8 path-traversal and unsafe file-upload vulnerability affecting its Security Management infrastructure. An unauthenticated remote attacker can upload and execute arbitrary scripts and load arbitrary Java classes, enabling remote code execution. Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent.
The company confirmed that the flaw was exploited in a small number of targeted attacks before fixes were available, though it has not identified the threat actor, victims, or objectives. Organizations should immediately deploy the R82.20 Security Hotfix or applicable fixed Jumbo Hotfix Accumulator, review Check Point-provided indicators and relevant logs/core dumps, and restrict management access—including TCP/19009—to trusted systems; where patching is delayed, SmartConsole Trusted Clients and firewall rules should limit access to approved IP addresses.
