DEV Community

jeffrey
jeffrey

Posted on

CVE-2026-93616: Why Check Point Management Servers Need Network-Level Protection

#cybersecurity #infosec #security

CVE-2026-93616: Why Check Point Management Servers Need Network-Level Protection

Vulnerability overview

CVE-2026-93616 is a critical path traversal vulnerability affecting Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. It is rated 9.8 under CVSS v3, classified as CWE-22, and was added to CISA's Known Exploited Vulnerabilities catalog on September 22, 2026, based on evidence of active exploitation. Check Point has confirmed that "a handful of customers" were attacked.
The vendor response to this vulnerability is notable for what it emphasizes: not a patch, but network access control.

Mechanism and exploitation conditions

CISA describes the flaw as a path traversal vulnerability that "allows an unauthenticated attacker to upload and execute arbitrary scripts." The traversal weakness lets an uploaded file escape the directory intended to contain it, and the server executes the resulting script.
Exploitation requires TCP port 19009 to be reachable on an affected build. Authentication is not required, so there is no credential barrier and no user interaction. The reported sequence is a direct connection followed by a crafted upload.
Exploitation in the wild is confirmed by the vendor and by CISA. A public proof-of-concept has not been confirmed, which does not reduce the urgency given the confirmed exploitation.

Impact

Script execution on a management server gives an attacker control inside the security control plane. Consequences include modifying the policy that gateways enforce, reading configuration material, and using the trusted management channel to reach managed devices.
The affected components span policy and telemetry. Security Management Server and Multi-Domain Security Management Server hold policy authority. Log Server and Multi-Domain Log Server retain activity history. SmartEvent holds correlated event data. Compromise of the logging or event components removes the visibility an organization depends on.

Affected products and scope

The affected products are Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent.
Reported affected releases include R82.20 with no Jumbo Hotfix, R82.10 with Jumbo Hotfix Take 44 or below, R82 with Jumbo Hotfix Take 126 or below, R81.20 with Jumbo Hotfix Take 166 or below, R81.10 (end of support) with Jumbo Hotfix Take 190 or below, and R81 (end of support). Older end-of-support releases from R80 through R81 are also reported as vulnerable.
Smart-1 Cloud and Check Point Firewall Appliances are reported as unaffected. Administrators should confirm their exact build and hotfix take level against the vendor advisory.

Exposure context

ZoomEye reports 1,068,268 instances matching app="Check Point" and zero matching vul.cve="CVE-2026-93616".
The product-level count shows that Check Point infrastructure is widely visible on the public internet. The CVE-level count of zero reflects indexing coverage, not an absence of risk. Neither figure establishes that a particular management interface is reachable on TCP port 19009, which is the condition that determines exploitability.

Remediation and mitigations

No final patch covering every affected release was available at the time of reporting, and LivePatch Take 28 and Take 29 do not fix the issue. This is why mitigation centers on network controls.
Place management servers behind a security gateway so they are not directly reachable from untrusted networks. Restrict TCP port 19009 to trusted IP addresses. Consult the official Check Point advisory for release-specific fix status, and apply vendor updates as they become available.
Validation should confirm from outside the network that no management or log server interface responds on port 19009, and should include a review of management server logs for unexpected upload or script execution activity. Because the vulnerable path requires no authentication, authentication-failure records are unlikely to reveal an attempt.

References

Top comments (0)