Affected Systems

Check Point Security Management Server: R82.20 (no Jumbo Hotfix), R82.10 (Take ≤44), R82 (Take ≤126), R81.20 (Take ≤166), R81.10 (Take ≤190), and R81/R80.x (all end-of-support versions). The vulnerability affects the management server's web service.

Exploitation Status

Actively exploited in the wild. Check Point confirmed targeted attacks on July 23, 2026. Patch released September 22, 2026—60-day window between exploitation and patch availability.

Business Impact

Unauthenticated remote code execution on Security Management Servers allows attackers to upload and execute arbitrary scripts via path traversal in the web service. CVSS 9.8/10. Compromised management servers control firewall policies for all managed Check Point gateways, enabling network-wide policy manipulation, lateral movement, and persistent access. Attack details (targets, attacker identity, post-exploitation activity) not disclosed by vendor.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately verify Check Point Security Management Server version and Jumbo Hotfix take against affected list in sk1000171
  • Apply the patch from Check Point support article sk1000171 for all affected management servers without delay
  • Use hunting guidance and indicators of compromise from sk1000171 to search management server logs for signs of exploitation since July 23, 2026
  • Review web service access logs for unusual file upload activity or path traversal attempts (e.g., directory traversal patterns like '../' in HTTP requests)
  • Audit firewall policy changes on managed gateways for unauthorized modifications that may indicate management server compromise
  • Restrict network access to management server web services to trusted administrative networks only, if not already implemented