Loading vulnerability…
Unauthenticated Root Code Execution in Check Point Security Management
CVE-2026-93616 is a critical pre-authentication directory-traversal and unsafe file-upload vulnerability in the Check Point Management web service. Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent across affected R80, R81, and R82 releases. The exploitation chain combines application-authentication bypass with arbitrary file writing: LoginSvcImpl.authenticateRemoteApplication trusts a caller-supplied distinguished name without verifying a corresponding TLS client certificate, allowing impersonation of a trusted application and creation of a privileged session. FileSvcRemote.uploadFileToServerFileSystem then combines an attacker-controlled destination filename with a temporary directory without adequate canonicalization, permitting writes outside the intended directory. These writes execute with root privileges and can be converted into arbitrary script execution or Java class loading. The vulnerability has a CVSS score of 9.8 and was exploited in limited targeted attacks beginning July 23, 2026, before public disclosure.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can completely compromise the confidentiality, integrity, and availability of an affected management server through root-level arbitrary file writes and remote code execution. Depending on the server's role, connectivity, and managed environment, compromise could expose administrative credentials, certificates, operational data, and audit records; enable unauthorized security-policy changes; disrupt management and logging functions; and facilitate lateral movement. Targeted exploitation is confirmed, but the attackers' identities and observed post-exploitation objectives are not established.
If you can’t patch tonight, do this now.
Place management systems behind a firewall or Security Gateway and restrict TCP port 19009 to explicitly trusted administrative hosts. Remove direct internet exposure and limit the Trusted Clients configuration to approved addresses; its implied access rule should be checked separately from the visible rule base. These controls reduce exposure but do not replace patching. Conduct retrospective hunting across management, logging, and SmartEvent systems for unusually long login usernames, correlated management-service crashes, resource-loading errors with traversal patterns, unexpected file modifications, scheduled-task changes, and Java management processes spawning shells. Published log indicators do not cover every demonstrated exploitation route, so supplement log review with file-integrity and process-execution telemetry.
Patch, then assume compromise.
Install the R82.20 Security Hotfix, or update the applicable Jumbo Hotfix Accumulator to R82.10 Take 45 or later, R82 Take 127 or later, R81.20 Take 170 or later, or R81.10 Take 192 or later. Verify the installed release and hotfix take explicitly. Migrate affected R80 through R81 branches without fixes to supported releases; migration from other end-of-support branches is also recommended. LivePatch Takes 28 and 29 do not remediate this vulnerability, and no LivePatch is available for it. Investigate previously exposed systems because patching does not remove established attacker access. Where compromise is suspected or confirmed, preserve evidence, assess unauthorized changes, and rotate potentially exposed administrative credentials and internal CA certificates.
No validated public exploits yet. Hidden: 4 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
183 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.