If your organization runs Check Point’s Security Management Server, stop what you are doing and read this. CISA just added CVE-2026-93616 to its Known Exploited Vulnerabilities catalog because attackers are already using it in the wild. The bug is a pre-authentication path traversal that lets anyone on the network upload and run arbitrary scripts on your management server — no login required, nothing to click, no user interaction.
The severity rating is about as bad as it gets: CVSS 9.8 out of 10. That is not an exaggeration. Check Point itself confirmed the flaw is exploited in the wild and acknowledged a number of targeted attacks in the field.
What the vulnerability is. CVE-2026-93616 is an improper limitation of a pathname to a restricted directory (CWE-22), commonly called a path traversal or directory traversal flaw, combined with a file upload weakness in the Check Point Management web service. An unauthenticated remote attacker can abuse it to upload a script to an arbitrary path and then execute it. They can also load an arbitrary Java class onto the server. In plain terms: an unauthenticated takeover of the management appliance.
Why that is so dangerous. The Management Server is the brain of a Check Point deployment. It stores and enforces security policy, processes administrator changes, and collects logs across the entire firewall estate. Whoever controls it can see your whole network and potentially change the rules. A single compromise here can cascade across every gateway it manages. Check Point lists the affected products as the Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Smart-1 Cloud, Firewall Appliances, and Spark Firewall are not affected.
This is part of a bigger wave. On September 22, CISA added four actively exploited flaws in edge and management products to its KEV catalog, all remotely exploitable without authentication, all carrying a September 25 federal remediation deadline. Alongside this Check Point issue, CISA flagged CVE-2026-85102, a Check Point improper certificate validation flaw with unauthenticated remote code execution on the gateway, plus CVE-2026-94127, a heap-based buffer overflow in F5 BIG-IP APM, and CVE-2026-93952 in Arista’s VeloCloud Orchestrator. The takeaway is clear: firewalls and the systems that manage them are at the top of attacker wish lists right now.
What you need to do.
Patch first, and patch correctly. Apply the R82.20 Security Hotfix, or one of the fixed Jumbo Hotfix Takes: R82.10 Take 45 or later, R82 Take 127 or later, R81.20 Take 170 or later, R81.10 Take 192 or later. Do not rely on Check Point LivePatch Take 28 or 29 — Check Point explicitly states those versions do not address this flaw.
Restrict who can reach the management layer. Limit TCP port 19009 access to trusted IP addresses. In SmartConsole, under Manage & Settings > Permissions & Administrators > Trusted Clients, restrict access to trusted internal IP addresses or subnets rather than “Any”. If you cannot deploy the hotfix immediately, put the vulnerable systems behind a firewall and allow only trusted IPs.
Upgrade end-of-support versions. Older branches such as R81.10, R80.x and below are out of support. Move them to a supported, patched release. Do not assume an unsupported build is safe.
Hunt for prior compromise. Check Point published indicators of compromise in its advisory. Check your management servers and logs for signs of an earlier intrusion. Patching closes the hole — it does not rule out that an attacker already got in. CISA is explicitly requiring forensic triage on exposed federal systems because of this exact concern. If you find anything suspicious, assume the server is compromised and start a full incident response, including password resets and a review of management policies.
Do not wait on this one. KEV-listed vulnerabilities are in active use, and the management layer is the highest-value target on your network. Treat every catalog addition as an emergency patching cycle, because delays are exactly what attackers are counting on.