Check Point CVE-2026-93616: Patch the Actively Exploited Management Server Zero-Day

By AiCybr Editorial · Published September 23, 2026

Check Point released fixes on September 22, 2026 for CVE-2026-93616, a CVSS 9.8 pre-authentication vulnerability affecting its Security Management products. Check Point says the flaw was exploited against a handful of customers in targeted attacks observed on July 23.

The vulnerability combines directory traversal and file upload behavior in the management web service, allowing an unauthenticated attacker to upload and execute arbitrary scripts on a vulnerable management server. Check Point's technical advisory lists Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent among the affected products.

Administrators should install the applicable September 22 fix immediately and review management-server logs for Check Point's published indicators of compromise. LivePatch Take 28/29 does not fix CVE-2026-93616; supported releases require the dedicated R82.20 security hotfix or a fixed Jumbo Hotfix Accumulator take.

Affected versions and fixed takes

Check Point lists the following affected release ranges and remediation points:

Check Point says Smart-1 Cloud already has the fix applied. Check Point Firewall Appliances and Spark Firewall are outside the affected-product list for CVE-2026-93616.

Why this needs immediate attention

The management tier controls security policy and other high-value administrative functions, so pre-authentication code execution on that tier creates a high-impact compromise path. Check Point's September 22 advisory says it observed a small number of targeted exploitation events rather than a broad campaign.

The company has not attributed the July attacks to a named threat actor or published a complete post-exploitation sequence. Those details are not required for the remediation decision: exploitation is confirmed by the vendor, affected versions are enumerated, and fixes are available.

How to hunt for exploitation

Check Point's sk1000171 advisory provides two concrete log checks for affected management systems.

First, administrators can inspect cpm.elg logs for unusually long usernames associated with the login path and correlate matching timestamps with FWM or MDS core dumps. Check Point says a matching login event and core dump can indicate an exploitation attempt.

Second, Check Point recommends searching the same logs for upgrade.base.ReflectionUtils errors involving allResourceFiles. Suspicious paths containing traversal sequences such as ../ can indicate an attempt to exploit the vulnerability.

The vendor also recommends restricting management-server access behind a Check Point Security Gateway or firewall and limiting TCP port 19009 to trusted IP addresses. These controls reduce exposure while administrators complete patching and investigation.

A second Check Point flaw is also under active exploitation

The September 22 alert also updates the status of CVE-2026-85102, a separate CVSS 9.8 pre-authentication remote-code-execution vulnerability in Security Gateway VPN certificate handling. Check Point originally released its fix on September 9 and says exploitation attempts against Spark customers began on September 12.

CVE-2026-85102 affects Security Gateway and Spark Firewall deployments across listed R81/R82 branches. Check Point reports attempts originating from anonymization infrastructure and recommends reviewing anomalous certificate-based Mobile Access logins and subsequent internal scanning activity. Customers that installed the September 9 fix are already protected from that vulnerability.

The two flaws require separate remediation checks. CVE-2026-93616 targets the management-server web service and was fixed on September 22; CVE-2026-85102 targets VPN certificate handling and had a fix available from September 9.

Remediation checklist

1. Inventory Check Point management servers and record the installed release and Jumbo Hotfix take.
2. For CVE-2026-93616, install the R82.20 security hotfix or the fixed Jumbo take for R82.10, R82, R81.20 or R81.10.
3. Treat LivePatch Take 28/29 as insufficient for CVE-2026-93616.
4. Restrict TCP/19009 and management access to trusted administrative networks and IP addresses.
5. Run the IOC checks in sk1000171 and investigate matching log events and core dumps.
6. Separately verify that gateways and Spark systems exposed to the CVE-2026-85102 conditions received the September 9 fix.

Bottom line

CVE-2026-93616 has crossed the threshold from a theoretical management-server weakness to a vendor-confirmed exploited vulnerability. Check Point has published exact affected-version ranges, fixed Jumbo takes, mitigations and IOC checks, giving administrators a direct patch-and-hunt path. Environments running the listed management releases should prioritize the September 22 fix and review for earlier compromise.

Sources

• Check Point — security alert covering CVE-2026-93616 and CVE-2026-85102: https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
• Check Point — CVE-2026-93616 technical advisory, affected versions, fixes and IOCs (sk1000171): https://support.checkpoint.com/results/sk/sk1000171/
• Check Point — CVE-2026-85102 remediation advisory (sk1000117): https://support.checkpoint.com/results/sk/sk1000117
• The Hacker News — independent report on the targeted exploitation and affected-version matrix: https://thehackernews.com/2026/09/check-point-warns-of-management-server.html