Affected Systems
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Fixed in R82.20 Security Hotfix. CVE-2026-93616 is a path traversal vulnerability allowing unauthenticated arbitrary script upload and execution.
Exploitation Status
Actively exploited in the wild. Check Point confirms a handful of customers have been attacked. No public PoC details available yet.
Business Impact
Unauthenticated attackers can upload and execute arbitrary scripts on Security Management Servers, which are central repositories for security policies and logs across enterprise networks. Successful exploitation grants attackers control over the security infrastructure, enabling policy manipulation, log tampering, and lateral movement. Low attack complexity increases risk. CISA and FBI have classified path traversal flaws as "unforgivable" since 2007.
Urgency
🔴 Immediate
Recommended Actions
- Apply R82.20 Security Hotfix immediately to all Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent instances.
- Review indicators of compromise published in Check Point's security advisory to identify evidence of successful exploitation in your environment.
- If immediate patching is not possible, place vulnerable Management Servers behind a firewall and restrict access to trusted IP addresses via Manage & Settings > Permissions & Administrators > Trusted Clients in SmartConsole.
- Monitor Audit and Admin login logs for suspicious activity, including unusual script uploads or unauthorized access attempts.
- Prioritize patching CVE-2026-16232 (critical authentication bypass released Friday) alongside CVE-2026-93616, as both target Management Server infrastructure.