Check Point Patches Critical Management Server Zero-Day Exploited in the Wild
Share
Check Point has issued urgent patches for a critical-severity zero-day vulnerability in its Management Server products that is currently being exploited by attackers.
The flaw, tracked as CVE-2026-93616, carries a CVSS score of 9.8. It is a directory traversal and file upload issue that allows unauthenticated attackers to upload and execute arbitrary scripts on the Management Server.
Check Point confirmed it is aware of several customers who have already been targeted by this exploit. The vulnerability affects several core management products, including Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent.
Patch Availability and Mitigation
To resolve the issue, Check Point has released the R82.20 Security Hotfix (TAR). Fixes are also included in the Jumbo Hotfix Accumulator for the following versions:
- R82.10 (Take 45)
- R82 (Take 127)
- R81.20 (Take 170)
- R81.10 (Take 192)
The vendor noted that standard LivePatch updates do not resolve CVE-2026-93616. As a mitigation measure, organisations are advised to restrict access to the Management Server behind a security gateway or firewall and limit access to port TCP/19009 to trusted IP addresses only.
Check Point has also released indicators of compromise (IoCs) to help organisations hunt for evidence of potential exploitation within their environments.
CISA Adds Flaw to Known Exploited Vulnerabilities Catalogue
The US Cybersecurity and Infrastructure Security Agency (CISA) has added the zero-day bug to its Known Exploited Vulnerabilities (KEV) catalogue. This follows recent action regarding another critical Check Point vulnerability, CVE-2026-85102.
That separate flaw, which also carries a CVSS score of 9.8, affects Check Point’s Security Gateway and Spark Firewall products. It involves improper validation of certificate data during VPN negotiation, which can allow remote, unauthenticated attackers to bypass authentication and execute arbitrary code. Check Point has observed exploitation attempts against Spark customers globally and has urged immediate patching for those affected.
