DEV Community

yutianle
yutianle

Posted on

CVE-2026-93616: Assessing Real Exposure in Check Point Deployments

#cybersecurity #infosec #security

CVE-2026-93616: Assessing Real Exposure in Check Point Deployments

Vulnerability overview

CVE-2026-93616 is a path traversal vulnerability in Check Point management and logging products, rated 9.8 (Critical) under CVSS v3 and classified as CWE-22. CISA added it to the Known Exploited Vulnerabilities catalog on September 22, 2026, citing evidence of active exploitation. Check Point has confirmed that "a handful of customers" were attacked.
Assessing exposure for this vulnerability requires separating three questions that are easy to conflate: how many Check Point assets exist, how many run affected builds, and how many expose the vulnerable interface to an untrusted network.

Mechanism and exploitation conditions

CISA states that the affected products "contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts." The traversal weakness allows an uploaded file to escape its intended directory, and the server executes the resulting script.
Exploitation requires reachability to TCP port 19009 on an affected build. No authentication is required. The reported sequence is a direct connection followed by a crafted upload that escapes its intended location.
Exploitation in the wild is confirmed by both the vendor and CISA. A public proof-of-concept has not been confirmed. The confirmed exploitation should drive prioritization.

Impact

Script execution on a management server places an attacker inside the control plane, where policy can be modified, configuration data read, and the trusted management channel used to reach managed devices. On logging and event components, the attacker gains access to the records used for detection and investigation.
The affected product set covers policy authority, activity history, and event correlation, which means a compromise can affect both an organization's defensive posture and its ability to reconstruct what happened.

Affected products and scope

The affected products are Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent.
Reported affected releases include R82.20 without a Jumbo Hotfix, R82.10 with Jumbo Hotfix Take 44 or below, R82 with Jumbo Hotfix Take 126 or below, R81.20 with Jumbo Hotfix Take 166 or below, R81.10 (end of support) with Jumbo Hotfix Take 190 or below, and R81 (end of support). Older end-of-support releases from R80 through R81 are also reported as vulnerable.
Smart-1 Cloud and Check Point Firewall Appliances are reported as unaffected. Because the affected set is defined by hotfix take level as well as release family, build-level verification is required.

Exposure context

ZoomEye reports 1,068,268 instances matching app="Check Point" and zero matching vul.cve="CVE-2026-93616".
The distinction between these figures is the core of exposure assessment here. The product-fingerprint count describes how many Check Point assets ZoomEye observes on the public internet; it says nothing about which builds they run or whether their management interfaces are reachable. The CVE-indexed count of zero describes indexing coverage for this identifier, not an absence of vulnerable systems. The population that actually matters is the subset with management interfaces reachable on TCP port 19009, and that subset must be determined by direct testing rather than inferred from aggregate counts.

Remediation and mitigations

No final patch covering all affected releases was available at the time of reporting, and LivePatch Take 28 and Take 29 do not resolve the flaw.
Restrict management server access so the interface sits behind a security gateway. Limit TCP port 19009 to trusted IP addresses. Follow the official Check Point advisory for release-specific fix status and apply vendor updates as they become available.
Validation should confirm from an external vantage point that no management or log server interface answers on port 19009, and should include a review of management server logs for unexpected upload or script execution activity. Because exploitation requires no authentication, authentication auditing alone is unlikely to surface an attempt.

References

Top comments (0)