CVE-2026-93616 turns a Check Point management server into a possible entry point: an unauthenticated remote attacker can abuse path traversal and file upload to execute arbitrary scripts. This is not a flaw in the firewall traffic path itself. It sits in the management web service—the control plane administrators rely on to define policy and push it to managed gateways.
Check Point says it saw a handful of pinpointed attacks on July 23, before its September 22 disclosure and fixes. The company’s public advisory confirms the activity but does not identify victims, an actor, malware, uploaded scripts, persistence, or follow-on actions. It also disclosed this alongside exploitation of CVE-2026-85102; details from that separate VPN issue should not be carried over to this one.
A web-service request can become code execution
Path traversal means manipulating a supplied file path so a server writes or reads outside the directory the application intended to expose. Here, Check Point’s description goes further: before logging in, an attacker can reach an arbitrary path, execute a script from an arbitrary path, and load an arbitrary Java class. In practical terms, the vulnerable service can be tricked into placing attacker-controlled code where the management system will run it.
That gives the attacker code execution on a system with unusually valuable access. Security Management Server is where administrators manage Check Point gateways, policies, objects, device state and updates. The related Multi-Domain role partitions that authority among separate business units, geographies or customers; Log Server and SmartEvent process the telemetry that those gateways send. A compromised management host is therefore a strong foothold for reaching configuration, credentials, administrative workflows and potentially the managed environment. The advisory does not publicly document the exact endpoint, request format, affected classes, or failed validation check.
The exposed roles are Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent Server. That puts large enterprises, distributed organisations, banks that segregate administration, and managed security or cloud providers especially in view, although smaller deployments can run the same management role. Quantum Force and Quantum Spark firewalls are not directly affected unless an appliance is also serving as the management system; Smart-1 Cloud was already patched.
Patch the control plane, then hunt it
This is confirmed in-the-wild exploitation and is listed in CISA’s Known Exploited Vulnerabilities catalogue. For US federal civilian agencies, the KEV remediation deadline was September 25. No ransomware campaign has been associated publicly. There is defensive checking code available, but no confirmed public exploit or working proof of concept had surfaced as of September 23; an often-cited repository is an IOC-checking tool, not evidence of a usable exploit.
Check Point released hotfixes on September 22. Upgrade to R82.20 Security Hot Fix Take 1; R82.10 Jumbo Hotfix Take 45 or later; R82 Take 127 or later; R81.20 Take 170 or later; or R81.10 Take 192 or later. The detailed vendor guidance contains the exact builds, mitigations, indicators and hunting instructions. LivePatch Takes 28 and 29 do not address the flaw, and unsupported releases should be moved to a supported branch rather than regarded as durably fixed.
Treat this as both patching and incident response: identify every management-role host, apply the appropriate hotfix, restrict management-service exposure, and hunt with the vendor’s indicators. CVE-2026-93616 is a reminder that the system administering security controls needs the same urgent asset visibility as any internet-reachable service; SecAlerts monitors an organisation’s actual software stack and alerts on new vulnerabilities affecting the products it runs.
