Check Point Software Technologies has released emergency patches to address a high-severity vulnerability in its Management Server, which has been actively exploited as a zero-day vulnerability. This critical security flaw, identified as CVE-2026-93616 with a CVSS score of 9.8, poses a significant threat by allowing unauthorized users to execute arbitrary scripts through directory traversal and file upload.
Vulnerability Impact and Affected Products
The cybersecurity firm has acknowledged that the vulnerability has been exploited in real-world attacks, affecting a limited number of its customers. The flaw impacts several Check Point products, including the Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent.
To mitigate this risk, Check Point has rolled out the R82.20 Security Hotfix (TAR) and incorporated these fixes into the Jumbo Hotfix Accumulator for versions R82.10 (Take 45), R82 (Take 127), R81.20 (Take 170), and R81.10 (Take 192).
Mitigation Strategies and Additional Support
In addition to the patches, Check Point advises customers to enhance security by restricting access to the Management Server using a security gateway or firewall, and by limiting access to TCP port 19009 to trusted IP addresses. It’s important to note that standard LivePatch updates do not address CVE-2026-93616.
To assist organizations in detecting potential exploitation, Check Point has also provided indicators of compromise (IoCs).
Broader Implications and Federal Response
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has reacted by adding the zero-day vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. This catalog also includes CVE-2026-85102, another serious flaw in Check Point’s Security Gateway and Spark Firewall products, which was addressed on September 9, 2026. This vulnerability allows attackers to bypass authentication and execute arbitrary code remotely.
Following the addition of these vulnerabilities to the KEV catalog, federal agencies have been mandated to patch both vulnerabilities within three days as per BOD 26-04 requirements.
Check Point continues to monitor the situation globally, urging customers who have not yet applied the necessary fixes to do so without delay.
This development underscores the importance of timely patch management and the need for organizations to stay vigilant against emerging cyber threats.
