DEV Community

kozhevniko
kozhevniko

Posted on

CVE-2026-93616 and the Risk of Exposing Check Point Management Interfaces

#cybersecurity #infosec #security

CVE-2026-93616 and the Risk of Exposing Check Point Management Interfaces

Vulnerability overview

CVE-2026-93616 is a path traversal vulnerability (CWE-22) in Check Point management and logging products, rated 9.8 (Critical) under CVSS v3. CISA added it to the Known Exploited Vulnerabilities catalog on September 22, 2026, citing evidence of active exploitation, and Check Point has confirmed attacks against a small number of customers.
The vulnerability is a useful case study in a recurring architectural problem: management interfaces that were never designed to face the public internet, placed where the public internet can reach them.

Mechanism and exploitation conditions

CISA's description states that the affected products "contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts." The traversal weakness lets an uploaded file escape the directory intended to contain it, and the server then executes the result.
The exposure requirement is specific: TCP port 19009 must be reachable from an untrusted network, and the target must run an affected build. No credentials are needed. The reported exploitation sequence is a direct connection followed by a crafted upload.
Exploitation in the wild is confirmed. A public proof-of-concept has not been confirmed. The confirmed exploitation is the fact that should drive prioritization.

Impact

Script execution on a management server places an attacker inside the control plane. From there, policy can be altered, configuration data can be read, and the trusted management channel can be used to reach managed devices. On logging and event components, the attacker gains access to the records used for detection and post-incident analysis.
The asymmetry is the point. A single exposed management interface can provide leverage over an entire managed estate, which is why the exposure condition matters more than the raw count of affected hosts.

Affected products and scope

The affected products are Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent.
Reported affected releases include R82.20 without a Jumbo Hotfix, R82.10 with Jumbo Hotfix Take 44 or below, R82 with Jumbo Hotfix Take 126 or below, R81.20 with Jumbo Hotfix Take 166 or below, R81.10 (end of support) with Jumbo Hotfix Take 190 or below, and R81 (end of support). Older end-of-support releases from R80 through R81 are also reported as vulnerable.
Smart-1 Cloud and Check Point Firewall Appliances are reported as unaffected. Administrators should confirm their exact build and hotfix take level against the vendor advisory, since the affected set is defined by both.

Exposure context

ZoomEye reports 1,068,268 instances matching app="Check Point" and zero matching vul.cve="CVE-2026-93616".
The gap between those two numbers is instructive. Product-level fingerprinting shows that Check Point infrastructure is extensively visible on the public internet. CVE-level indexing shows nothing for this identifier, which reflects indexing coverage rather than an absence of risk. The population that matters is the subset with management interfaces reachable on TCP port 19009, and that subset cannot be inferred from either aggregate figure.

Remediation and mitigations

No final patch covering all affected releases was available at the time of reporting, and LivePatch Take 28 and Take 29 do not resolve the flaw. Mitigation is therefore primarily about reachability.
Restrict management server access so the interface sits behind a security gateway. Limit TCP port 19009 to trusted IP addresses. Consult the official Check Point advisory for release-specific fix status and apply vendor updates as they become available.
Validation should confirm from an external vantage point that no management or log server interface answers on port 19009, and should include a review of management server logs for unexpected uploads or script execution. Because authentication is not required for exploitation, authentication auditing alone is unlikely to surface an attempt.

References

Top comments (0)