Full Report
Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the company said. The flaw, CVE-2026-93616, allows an attacker who can access the server's web service to run scripts on it without logging in. Check Point released a fix on September 22 for the server that controls firewall policies for the Check Point
Analysis Summary
# Vulnerability: Check Point Security Management Server Pre-Authentication Path Traversal
## CVE Details
- **CVE ID:** CVE-2026-93616
- **CVSS Score:** 9.8 (Critical)
- **CWE:** Path Traversal (Specific CWE ID not provided, but described as a flaw in limiting file/folder access)
## Affected Systems
- **Products:** Check Point Security Management Server (controls firewall policies for managed gateways).
- **Versions:**
- **R82.20:** No Jumbo Hotfix installed.
- **R82.10:** Jumbo Hotfix Take 44 or below.
- **R82:** Jumbo Hotfix Take 126 or below.
- **R81.20:** Jumbo Hotfix Take 166 or below.
- **R81.10:** Jumbo Hotfix Take 190 or below (End of Support).
- **End of Support (Legacy):** R81, R80.40, R80.30, R80.20, R80.10, and R80.
- **Configurations:** Systems running the management server's web service that are accessible to the attacker.
## Vulnerability Description
CVE-2026-93616 is a critical path traversal vulnerability within the Security Management Server's web service. The service fails to properly sanitize or restrict requests to specific directories. An unauthenticated attacker can exploit this flaw to upload malicious scripts to the server and subsequently execute them with the privileges of the web service, leading to remote code execution (RCE).
## Exploitation
- **Status:** Exploited in the wild (Targeted attacks observed starting July 23, 2026).
- **Complexity:** Low (Pre-authentication; no credentials required).
- **Attack Vector:** Network (Access to the server's web service).
## Impact
- **Confidentiality:** High (Potential for full system access).
- **Integrity:** High (Ability to upload and run arbitrary scripts/modify firewall policies).
- **Availability:** High (Potential for system takeover or disruption).
## Remediation
### Patches
Check Point released fixes on September 22, 2026. Administrators should refer to support article **sk1000171** for specific fixed builds.
* **Note:** Previous LivePatches (e.g., Take 28/29 for CVE-2026-91843) do **not** protect against this vulnerability.
### Workarounds
The article does not list specific workarounds. The primary recommendation is immediate patching and restricting access to the Management Server's web interface to trusted IPs only.
## Detection
- **Indicators of Compromise (IoC):** Check Point provides specific IoCs and hunting guidance in support article **sk1000171**.
- **Detection Methods:** Administrators should audit web server logs for unusual path traversal patterns or unauthorized script uploads occurring around or after July 23, 2026.
* **Crucial Note:** Installing the patch does not remediate an existing compromise; active hunting is required.
## References
- **Check Point Advisory:** hxxps://blog[.]checkpoint[.]com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
- **Support Article (Fixes/IoCs):** hxxps://support[.]checkpoint[.]com/results/sk/sk1000171
- **CVE Record:** hxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-93616