DEV Community

Anoymask
Anoymask

Posted on

Check Point CVE-2026-93616: Actively Exploited Pre-Authentication Path Traversal Leading to Script Execution

#security #threatintel

1. Basic Information

  • Original Title: CVE-2026-93616: Directory Traversal and File upload allows execution of arbitrary script on the Management Server
  • Vendor: Check Point
  • Published Date: 2026-09-20
  • Updated Date: 2026-09-22
  • Collected Date: 2026-09-23T08:14:06+09:00
  • Original Source: Check Point sk1000171
  • Severity: Critical (CVSS-based; Check Point rates the security alert as High)
  • Severity Basis: CVE-2026-93616 has a CVSS v3.1 score of 9.8 and allows an unauthenticated attacker to exploit directory traversal and file upload handling to execute arbitrary scripts on affected management servers. Check Point has confirmed exploitation in the wild involving a small number of targeted customers.
  • Related Source: Check Point: Security Advisory on Active Exploitation
  • Related Source: BleepingComputer: Active Exploitation Report
  • Related Source: Check Point: R82.20 Security Hotfix
  • Related Source: CVE.org: CVE-2026-93616
  • Associated Malware: Not disclosed
  • Associated Threat Actor: Unattributed
  • CVE: CVE-2026-93616
  • Target Products and Services: Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, SmartEvent

  • Target Versions:

    • R82.20
    • R82.10 Jumbo Hotfix Take 44 or earlier
    • R82 Jumbo Hotfix Take 126 or earlier
    • R81.20 Jumbo Hotfix Take 166 or earlier
    • R81.10 Jumbo Hotfix Take 190 or earlier (End of Support)
    • R80, R80.10, R80.20, R80.30, R80.40, and R81 (all End of Support)

2. Executive Summary

CVE-2026-93616 is an actively exploited pre-authentication path traversal and file upload vulnerability in the Check Point Management web service. It allows an unauthenticated attacker to execute a script from an arbitrary path and load an arbitrary Java class on an affected server.

Check Point reported observing a small number of targeted attacks on July 23, 2026. The payloads, persistence mechanisms, and subsequent actions taken against management policies or managed gateways have not been disclosed.

3. Attack Flow

Public information confirms active exploitation but does not disclose the exact exploit request, uploaded payload, persistence mechanism, or post-compromise activity.

From Pre-Authentication Path Traversal to Script Execution

  1. An attacker obtains network access to TCP/19009 on an affected management or log server.
  2. The attacker sends an unauthenticated request to the vulnerable Check Point Management web service.
  3. Directory traversal and file upload weaknesses allow the attacker to upload a malicious file and execute a script from an arbitrary path or load an arbitrary Java class.
  4. After obtaining code execution, the attacker may attempt to access management data or perform additional operations. However, Check Point has not disclosed what actions were taken in the observed attacks.

4. Attacker Position and Execution Location

  • The attacker is remote, unauthenticated, and has network reachability to TCP/19009 on the affected server.
  • The vulnerable processing and resulting script or Java class execution occur on the affected Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, or SmartEvent server.
  • No end-user interaction is required.

5. Visibility for Victims and Administrators

Victims

  • No user interaction is required, and the attack may not produce a visible warning for ordinary users.
  • Observable evidence is primarily available in server logs, core dumps, file activity, and process telemetry.

Administrators

  • Vendor-provided indicators include usernames longer than 1,000 characters in cpm.elg, FWM or MDS core dumps generated at the same time, and ReflectionUtils errors containing suspicious paths such as ../.
  • These indicators show potential exploitation attempts and do not, by themselves, confirm successful script execution.
  • Suspicious files, scripts, Java class loading, child processes, management configuration changes, or outbound connections provide stronger evidence of successful compromise.

6. Success and Failure Conditions

Success Conditions

  • The target product is running an affected version or an unpatched Jumbo Hotfix Take.
  • The attacker can reach TCP/19009 on the affected server.
  • The applicable R82.20 Security Hotfix or fixed Jumbo Hotfix has not been installed.
  • The malicious request reaches the vulnerable Management web service and successfully triggers arbitrary-path script execution or Java class loading.

Failure and Prevention Conditions

  • Apply the R82.20 Security Hotfix or one of the following fixed Jumbo Hotfix Takes:

    • R82.10 Take 45 or later
    • R82 Take 127 or later
    • R81.20 Take 170 or later
    • R81.10 Take 192 or later

  • Do not rely on Check Point LivePatch Take 28 or 29, because these LivePatch versions do not address CVE-2026-93616.

  • Restrict TCP/19009 access to trusted IP addresses.

  • Limit Trusted Clients to trusted internal IP addresses or subnets rather than Any.

  • Upgrade End-of-Support versions to a supported and patched release.

7. Impact of Successful Exploitation

  • Successful exploitation allows arbitrary-path script execution or loading of an arbitrary Java class on the affected server.
  • Because Check Point management servers centrally handle security policies, administrator activity, logs, and gateway management, a successful compromise could potentially affect these connected functions.
  • Check Point has not disclosed whether the observed attackers modified policies, added administrators, tampered with logs, accessed managed gateways, or established persistence.
  • The malware, scripts, commands, and data accessed in the observed attacks remain undisclosed.

8. Observable Logs

  • email: No evidence indicates that email was used as an initial access vector.
  • proxy_swg_dns: Review historical outbound connections from affected servers to unfamiliar external destinations. Inbound attack requests may be more visible in firewall, management service, or reverse-proxy logs.
  • endpoint_edr: Where host telemetry is available, check for suspicious files, scripts, Java processes or class loading, unexpected child processes, and FWM or MDS core dumps under /var/log/dump/usermode/.
  • identity_idp: Review unexpected changes to Check Point administrators, permissions, Trusted Clients, API sessions, or authentication settings.
  • saas_cloud: Check Point lists Smart-1 Cloud as not affected because the fix has already been applied. For self-managed servers hosted in cloud environments, review control-plane activity, snapshots, security groups, and audit logs.
  • network: Review access to TCP/19009, particularly from untrusted sources, and correlate it with cpm.elg anomalies, core dumps, file creation, process execution, and subsequent outbound traffic.

9. Determining Attack Success

Confirmed in Public Information

  • Active Exploitation Confirmed; Individual Impact Undisclosed: Check Point confirmed a small number of targeted exploitation incidents observed on July 23, 2026. The company has not disclosed the uploaded payloads, commands executed, persistence mechanisms, or subsequent impact on each customer.

Internal Evaluation Criteria

  • Potential Exploit Attempt Observed: Treat a username longer than 1,000 characters accompanied by a concurrent FWM or MDS core dump as a potential exploitation attempt. A matching ReflectionUtils error containing directory traversal sequences should also be treated as a potential attempt.
  • Initial Execution Confirmed: Correlate a malicious request with attacker-controlled file creation, script execution, arbitrary Java class loading, child processes, or command output.
  • Subsequent Compromise Confirmed: Verify administrator changes, Trusted Clients modifications, policy changes, log tampering, credential access, persistence, or operations against managed gateways using additional evidence.

10. Investigation Playbook

Trigger

  • Start an investigation when vendor-provided IOC searches return results, particularly for suspicious requests to TCP/19009, oversized usernames, ReflectionUtils errors containing traversal sequences, or concurrent FWM or MDS core dumps.

Initial Verification

  • Identify all affected Security Management, Multi-Domain Security Management, Log, Multi-Domain Log, and SmartEvent servers.
  • Verify the running product versions, Jumbo Hotfix Takes, installation status of the R82.20 Security Hotfix, and network reachability to TCP/19009.
  • Confirm that Check Point LivePatch Take 28 or 29 has not been incorrectly treated as remediation for this vulnerability.

Endpoints

  • Preserve cpm.elg, /var/log/dump/usermode/, suspicious files, process trees, file metadata, Java class-loading evidence, command history, and relevant system logs.
  • Record timestamps before collecting or modifying evidence.

Authentication and Cloud

  • Review Check Point administrators, Trusted Clients, permissions, API sessions, authentication history, and policy publication records.
  • For cloud-hosted management servers, review security group changes, administrative actions, snapshots, and access logs.

Subsequent Actions

  • Investigate credential access, policy changes, log deletion, persistence, actions against managed gateways, outbound connections, and additional payload execution.
  • Review connected gateways and administrator workstations if evidence indicates that the management server was successfully compromised.

Containment

  • Immediately block untrusted access to TCP/19009 and restrict Trusted Clients.
  • If exploitation is suspected, preserve evidence and isolate the affected server according to the organization's incident response procedures while maintaining necessary security-management continuity.
  • Apply the appropriate Security Hotfix or Jumbo Hotfix.
  • Rotate administrative credentials, API credentials, and other secrets that may have been accessible from the compromised server.

Determination Categories

  • Evaluate scanning, exploit attempts, file placement, script or Java class execution, management-plane access, and subsequent compromise separately.

11. Defense and Detection Ideas

Single Event

  • Detect a username longer than 1,000 characters in cpm.elg followed by an FWM or MDS core dump at the same timestamp.
  • Detect ReflectionUtils errors involving Failed to load allResourceFiles map from, particularly when the path contains traversal sequences such as ../.
  • Detect unknown scripts, files, Java class loads, and unexpected child processes on affected servers.

Time-Series Correlation

  • Correlate connections to TCP/19009, cpm.elg anomalies, core dumps, file creation, script execution, Java class loading, management configuration changes, and outbound connections.

Hunting Perspective

  • Run the vendor-provided IOC searches across all Security Management, Multi-Domain Security Management, Log, Multi-Domain Log, and SmartEvent servers.
  • Identify systems running vulnerable Jumbo Hotfix Takes or End-of-Support versions.
  • Review the period before patch installation, including historical logs and core dumps.

Log Gaps

  • The vendor-provided IOC patterns indicate potential exploitation attempts but do not prove script execution.
  • Without process, file, and Java runtime telemetry on management servers, it may be impossible to distinguish a failed attempt from successful code execution.
  • Forward management logs and system telemetry to a separate system so that evidence does not exist only on a potentially compromised server.

Priority Countermeasures

  • Urgently apply the relevant Security Hotfix or Jumbo Hotfix.
  • Investigate the pre-patch period using the vendor-provided IOC searches.
  • Restrict management services to trusted IP addresses, protected management networks, or approved VPN paths.
  • Limit Trusted Clients to explicitly approved internal addresses.

12. Facts / Inference / Hypothesis

Facts

  • CVE-2026-93616 is a pre-authentication path traversal and file upload vulnerability in the Check Point Management web service.
  • The vulnerability allows an unauthenticated attacker to execute a script from an arbitrary path and load an arbitrary Java class.
  • Check Point confirmed exploitation in the wild and reported a small number of targeted attacks observed on July 23, 2026.
  • The CVSS v3.1 score is 9.8.
  • Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent.
  • Check Point lists Smart-1 Cloud, Check Point Firewall Appliances, and Check Point Spark Firewall as not affected.
  • The R82.20 Security Hotfix and fixed Jumbo Hotfix Takes for the supported branches are available.
  • Check Point LivePatch Take 28 and Take 29 do not address this vulnerability, and no LivePatch fix is available.

Inference

  • Because an affected management server centrally handles policies, administrators, logs, and managed gateways, a confirmed compromise should be investigated as a potential management-plane breach rather than an isolated server incident.
  • Restricting TCP/19009 and Trusted Clients reduces exposure but does not eliminate the need to patch or investigate historical activity.

Hypothesis

  • The observed attackers may have deployed additional payloads or persistence mechanisms after exploitation, but no such activity has been confirmed in public disclosures.

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (Confidence: High) — Exploits a pre-authentication vulnerability in a network-reachable Check Point Management web service.

No additional technique is assigned because Check Point has not disclosed the scripts, commands, interpreters, persistence mechanisms, or subsequent actions used in the observed attacks.

14. Uncertainties and Additional Investigation

  • The threat actors, source infrastructure, exploit request details, uploaded payloads, and executed commands have not been disclosed.
  • The exact number of affected customers, geographic distribution, and compromise scope are unspecified.
  • It is unknown whether the attackers modified security policies, added administrators, accessed managed gateways, tampered with logs, or established persistence.
  • Public information does not identify additional indicators beyond the vendor-provided log and core-dump patterns.

15. Impact on SOCs and Organizations

Organizations must verify versions and Jumbo Hotfix Takes across all Security Management, Multi-Domain Security Management, Log, Multi-Domain Log, and SmartEvent servers—not only R82.20 systems.

In addition to applying the appropriate fix, restrict TCP/19009 and Trusted Clients, then investigate the entire pre-patch period using vendor-provided IOC searches, core dumps, and file and process evidence. Because the published indicators identify potential attempts rather than confirmed execution, organizations should preserve supporting telemetry before drawing conclusions about compromise.

16. Summary by Target Audience

  • For SOCs: Correlate oversized usernames in cpm.elg, ReflectionUtils traversal errors, concurrent core dumps, file creation, script or Java class execution, management changes, and outbound connections.
  • For Administrators: Apply the appropriate Security Hotfix or fixed Jumbo Hotfix Take, restrict TCP/19009, and limit Trusted Clients to approved management sources.
  • For Users: No user interaction is required. Management infrastructure operators should follow the vendor's patching and compromise-assessment procedures.

Top comments (0)