Security teams running Check Point infrastructure can lock down a critical remote code execution path after the vendor shipped emergency hotfixes for a path traversal zero-day that is already being exploited against enterprise customers. The flaw, tracked as CVE-2026-93616, sits in the Security Management Server and lets unauthenticated attackers upload and run arbitrary scripts, so applying the R82.20 Security Hotfix closes one of the most direct routes an attacker has into a Check Point environment today.<\/p>\n
CVE-2026-93616 is a path traversal flaw in Check Point’s Security Management Server, the central component that stores security policies, processes administrator changes, and collects logs across enterprise networks. Because the bug is reachable without credentials and can be exploited with low attack complexity, an attacker who reaches a vulnerable management server can upload a script of their choice and execute it on the underlying system.<\/p>\n
CISA and the FBI have publicly pressed software vendors since May 2024 to remove path traversal weaknesses before shipping, calling such flaws unforgivable defects that have been known and warned about since at least 2007.<\/p>\n
Check Point lists the full set of vulnerable products as:<\/p>\n
All of these components share the same underlying management code path, so the hotfix should be applied consistently across the management tier rather than treated as a single-product fix.<\/p>\n
Check Point confirmed that the vulnerability is being exploited in the wild and that the company is aware of a handful of customers who have been attacked. The first wave of exploitation attempts was observed on September 12, with the activity targeting Spark customers in particular. The vendor has shared indicators of compromise in its security advisory so defenders can search their environments for signs of prior access.<\/p>\n
Because the management tier stores policies, administrator credentials, and logs, any successful intrusion into a Security Management Server typically grants the attacker broad visibility into the rest of the network. Treating the hotfix as urgent, rather than routine, is consistent with the exposure an attacker gains once they are inside.<\/p>\n
For organizations that cannot deploy the hotfix immediately, Check Point recommends hardening the management environment by placing the server behind a firewall and limiting access to trusted IP addresses through the Manage Settings, Permissions, Administrators, Trusted Clients section of the SmartConsole dashboard. The vendor also pointed administrators at its indicators of compromise so teams can hunt for evidence that an attacker already reached the server before mitigations were applied.<\/p>\n
CVE-2026-93616 lands in a stretch of 2026 that has already produced several exploited flaws across the Check Point product line:<\/p>\n
Each of these flaws targets a different layer of the Check Point stack, from VPN gateways to SmartConsole login, but together they show how consistently attackers are probing the vendor’s management and remote access surface. For security teams, that means patching CVE-2026-93616 is best treated as part of a broader review of the Check Point estate, not a one-off maintenance task.<\/p>\n
The fastest path to closing the exposure is installing the R82.20 Security Hotfix on every Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent instance in the environment. While the patch is being staged, restricting Trusted Clients to known IP ranges and pulling the management server behind a firewall cuts off the unauthenticated path attackers are using today. Reviewing the published indicators of compromise against historical logs gives defenders a way to tell whether any of the September 12 activity already reached a server that has not yet been patched.<\/p>\n
Security teams that also run SmartConsole should pull the Audit and Admin login logs for the “Username too long” alert pattern to rule out exploitation of CVE-2026-16232, and they should verify that the earlier VPN fixes for CVE-2026-85102 and CVE-2026-85103 are in place.<\/p>\n
CVE-2026-93616 is a critical path traversal vulnerability in Check Point’s Security Management Server that lets unauthenticated attackers upload and execute arbitrary scripts with low attack complexity.<\/p>\n
Check Point lists Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent as the affected products covered by the R82.20 Security Hotfix.<\/p>\n
Yes. Check Point confirmed the vulnerability is exploited in the wild and that a handful of customers have been attacked, with the first wave of exploitation attempts observed on September 12 against Spark customers.<\/p>\n