Check Point Patches Critical Actively Exploited Security Flaw
Unauthenticated attackers can upload and execute scripts on vulnerable servers.
1Critical vulnerability disclosed
Check Point has released emergency hotfixes for CVE-2026-93616, a critical path traversal flaw in its Security Management Server. The vulnerability allows unauthenticated attackers to upload malicious scripts and execute them on vulnerable servers. This affects multiple products including Security Management Server, Multi-Domain Security Management Server, and Log Server. The company confirmed active exploitation in the wild and awareness of several compromised customers.
2Wide-ranging enterprise impact
The Security Management Server controls security policies, admin activity, and system logs across Check Point deployments. A compromise could therefore affect an entire enterprise network's security posture. The vulnerability's severity is heightened by its pre-authentication exploitation vector, meaning attackers don't need valid credentials. Check Point has published indicators of compromise (IOCs) to help security teams detect attacks.
3Immediate mitigation required
The fix is available in R82.20 Security Hotfix, which Check Point urges customers to install immediately. For organizations that can't patch immediately, Check Point recommends placing vulnerable systems behind firewalls with restricted IP access. This can be configured through SmartConsole's Manage Settings → Permissions Administrators → Trusted Clients. However, this is only a temporary workaround.
4Ongoing security challenges
This marks the third critical Check Point vulnerability disclosed recently. Two weeks prior, the Dutch National Cyber Security Centre warned about two critical VPN flaws (CVE-2026-85102, CVE-2026-85103). In July, Check Point patched CVE-2026-16232, another authentication bypass flaw affecting management servers. The frequency highlights persistent security challenges in network infrastructure products.
5Potential unreported compromises
While Check Point knows of several compromised customers, the actual number may be higher. Some attacks might go undetected or unreported. The company's advisory includes detailed IOCs to help organizations investigate potential breaches. Security teams should prioritize reviewing logs for these indicators, especially in environments running vulnerable Check Point products.
6Vulnerability specifics
The path traversal flaw allows attackers to bypass normal directory restrictions and upload scripts to unauthorized locations. These scripts can then be executed with server privileges. The vulnerability affects multiple management components including SmartEvent, showing how a single flaw can impact various security monitoring and enforcement functions across an enterprise.
7Administrative access risks
Similar to July's CVE-2026-16232, this new vulnerability threatens administrative access. While CVE-2026-16232 allowed obtaining SmartConsole login tokens, this new flaw enables direct script execution. Both demonstrate how management interfaces, when compromised, can give attackers significant control over enterprise security infrastructure.
8Security management implications
The repeated vulnerabilities in Check Point's management servers highlight the critical nature of securing security infrastructure itself. Organizations must implement layered protections, timely patching, and continuous monitoring even for systems designed to provide security. The incidents underscore how security tools can become high-value targets for attackers.
Original article: Security Affairs — Check Point Patches Critical Actively Exploited Security Flaw