CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Check Point Security Management: pre-auth path traversal to arbitrary script execution, exploited as a zero-day since July

cve · CVE-2026-93616

Coverage
1
first 2026-09-23 → last 2026-10-04
Latest activity
2026-10-04
Check Point patches a management-server zero-day it says has already been used in a handful of pinpointed…
Peak priority
critical
1 critical
Targets
public-sector
sectors: public-sector
Sources cited
6
6 hosts

Action items (4)

Do-now tasks recorded on the entries about CVE-2026-93616, newest first. Check the date before acting on an older one.

  • Immediate action: Check Point confirms this pre-authentication path-traversal flaw was exploited as a zero-day against a handful of customers, with attacks observed on 2026-07-23. Apply the R82.20 Security Hotfix or the appropriate Jumbo Hotfix Accumulator (R82.10 Take 45+, R82 Take 127+, R81.20 Take 170+, R81.10 Take 192+) immediately; the September LivePatch does not cover this issue. Until patched, restrict TCP/19009 on every affected server to trusted administrative IP ranges via Trusted Clients / implied rules, and check the file-integrity paths in the 2026-10-04 update below, since the two log indicators miss the published exploit route.
    2026-09-23CVE-2026-93616
  • Apply the R82.20 Security Hotfix or the appropriate Jumbo Hotfix Accumulator to every Check Point Security Management / Multi-Domain Security Management / Log / Multi-Domain Log / SmartEvent server now; no LivePatch exists for this issue.
    2026-09-23CVE-2026-93616
  • Until patched, restrict TCP/19009 to trusted administrative IP ranges via Trusted Clients / implied rules on every affected server.
    2026-09-23CVE-2026-93616
  • On every affected server that was reachable on TCP/19009 while unpatched, check /etc/cron.d, authorized_keys, the startup paths and anything new under $FWDIR/conf/SMC_Files for unexpected changes, since the two log indicators miss the published exploit route.
    2026-09-23CVE-2026-93616

Defender insights

What each entry about CVE-2026-93616 tells a defender to do, newest first.

2026-09-23CRITICALexploitedCheck Point patches a management-server zero-day it says has already been used in a handful of pinpointed attacks

Triage

Story timeline

  1. 2026-09-23CVE-2026-93616, Check Point Security Management: pre-authentication path traversal to arbitrary script execution, exploited as a zero-day, with attacks observed on 2026-07-23 (CVSS 9.8)
    trending-vulnerabilitiesCheck Point patches a management-server zero-day it says has already been used in a handful of pinpointed attacks

Hunting pivots

Affected products
Check Point Log ServerCheck Point Multi-Domain Log ServerCheck Point Multi-Domain Security Management ServerCheck Point Security Management ServerCheck Point SmartEvent
Tags
actively-exploitedcisa-kevpatch-availablepre-authrcevulnerabilitieszero-day
ATT&CK techniques (2 across 4 tactics)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessExploit Public-Facing Application
  • ExecutionScheduled Task/Job: Cron
  • PersistenceScheduled Task/Job: Cron
  • Privilege EscalationScheduled Task/Job: Cron

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-23/cve-2026-93616-check-point-security-mgmt-path-traversal · ATT&CK page ↗

Execution TA0002

T1053.003Scheduled Task/Job: Cron×1

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

Evidence: 2026-09-23/cve-2026-93616-check-point-security-mgmt-path-traversal · ATT&CK page ↗

Persistence TA0003

T1053.003Scheduled Task/Job: Cron×1

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

Evidence: 2026-09-23/cve-2026-93616-check-point-security-mgmt-path-traversal · ATT&CK page ↗

Privilege Escalation TA0004

T1053.003Scheduled Task/Job: Cron×1

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

Evidence: 2026-09-23/cve-2026-93616-check-point-security-mgmt-path-traversal · ATT&CK page ↗

Entries about Check Point Security Management: pre-auth path traversal to arbitrary script execution, exploited as a zero-day since July (1)

2026-09-23 · view entry permalink →

CRITICALCVE-2026-93616exploitedupdatedNATOA1

CVE-2026-93616, Check Point Security Management: pre-authentication path traversal to arbitrary script execution, exploited as a zero-day, with attacks observed on 2026-07-23 (CVSS 9.8)

Check Point discloses a pre-authentication directory-traversal and file-upload vulnerability that lets an unauthenticated attacker upload and execute arbitrary scripts on the Check Point Management Server (Check Point Support, sk1000171, 2026-09-22), which in Check Point Research's words "allows an attacker to execute a script from an arbitrary path and load an arbitrary Java class" (Check Point Research, 2026-09-22). It affects Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent; Smart-1 Cloud already carries the fix, and Security Gateway appliances and Spark Firewall are not affected. Check Point states it identified "a handful of pinpointed attacks" exploiting this as a zero-day on 2026-07-23 (Check Point Research, 2026-09-22), roughly two months before the 2026-09-22 disclosure and fix. Affected versions: R82.20 (all takes), R82.10 Jumbo Hotfix Take 44 or lower, R82 Take 126 or lower, R81.20 Take 166 or lower, R81.10 Take 190 or lower (end-of-support), and the end-of-support R80/R80.10–R80.40/R81 lines. Fixed in the R82.20 Security Hotfix, or Jumbo Hotfix Accumulator R82.10 Take 45+ / R82 Take 127+ / R81.20 Take 170+ / R81.10 Take 192+; Check Point published no fix for the end-of-support trains older than R81.10, and upgrading is the only remediation for them (Bishop Fox, 2026-10-01). Check Point states plainly "because of the nature of the fix, a LivePatch is not be available for this issue" (Check Point Support, sk1000171, 2026-09-22); the September LivePatch (Take 28/29) that addressed the unrelated CVE-2026-91843 flaw does not cover this vulnerability (The Hacker News, 2026-09-22). CISA added it to KEV the same day (CISA KEV, catalogue version 2026.09.22). This is a distinct, unrelated flaw from CVE-2026-85102 (a separate Check Point Security Gateway/Spark VPN certificate-validation RCE, disclosed 2026-09-09, with exploitation attempts reported from 2026-09-12 (Check Point Research, 2026-09-22)), with different components and no CVE overlap.

Detection concept, per Check Point's own two independent indicators of compromise (Check Point Support, sk1000171, 2026-09-22): first, a pre-authentication login attempt whose username field is anomalously long (over 1,000 characters) in the management-process log, occurring at the same timestamp as a management-process core dump, indicates a crash consistent with exploitation attempt; second, a resource-loading error referencing a file path containing parent-directory-reference sequences in the same log, which Bishop Fox says fires only when an upgrade-tools load fails and not on the route it published (see the 2026-10-04 update below). Triage: the first indicator is diagnostic only as its own correlated pair: an anomalously long username alone is not, and Bishop Fox attributes that crash signature to the separate CVE-2026-91843, not to this traversal (Bishop Fox, 2026-10-01). The second indicator, a traversal-pattern sequence inside the resource-loading error path, signals an attempt on the upgrade-service route when it appears, but its absence says little (Bishop Fox, 2026-10-01). Hardening: because no LivePatch exists, restrict network reachability to the management web service (Check Point names TCP/19009 specifically) to trusted administrative IP ranges via the platform's Trusted Clients or implied-rule mechanism, which Bishop Fox calls Check Point's primary mitigation (Bishop Fox, 2026-10-01).

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on the Check Point Management Server. This vulnerability is exploited in the Wild. Check Point is aware of a handful of customers who have been attacked.

Check Point Support (sk1000171) 2026-09-22

As of the advisory publications date, we observed a handful of pinpointed attacks on July 23, 2026.

Check Point Research (blog) 2026-09-22

Because of the nature of the fix, a LivePatch is not be available for this issue.

Check Point Support (sk1000171) 2026-09-22

One exploit ran end to end against both unpatched hosts, confirming root on each, self-contained over the exposed port.

It fires only when an upgrade-tools load fails, which makes it a weak net both ways.

The primitive underneath is an arbitrary root write, so what catches this is file-integrity monitoring rather than a log grep.

Check Point remediated more than it described.

Bishop Fox 2026-10-01
Updaterun 2026-10-04T0405Z-inteltitlesummaryimmediate_actiontagstechniquescvessourcesevidencesourcing_noteactionsbody

Bishop Fox published on 2026-10-01 a lab reproduction of an unauthenticated root code-execution chain on unpatched R81.10 and R82.10 management servers, run end to end over TCP 19009 (Bishop Fox, 2026-10-01). The chain mints a session by presenting the server's own internal certificate name, which the server accepts from a caller-supplied string without checking that a certificate was presented, then uses the file service to write a file anywhere as root; overwriting a stock scheduled-task file makes the system's cron daemon run the attacker's command as root with no further request, and the output is read back over the same session (Bishop Fox, 2026-10-01). Bishop Fox confirmed two further routes from the same write to code execution and says closing any one leaves the others standing (Bishop Fox, 2026-10-01). The post describes the chain but links only a patch-state scanner, not the exploit script.

Bishop Fox reads the hotfix as closing three defects while the advisory names two: the forged login, the unbounded file write and the upgrade-service parameter validation, with either of the first two alone breaking the chain; this is its comparison of the shipped code, not a Check Point statement (Bishop Fox, 2026-10-01). Its scanner reads patch state from outside with one benign request to the management port and, per its README, does not detect prior compromise (Bishop Fox, 2026-10-01).

Bishop Fox says Check Point's second indicator fires only when an upgrade-tools load fails and is never reached by this route, so it leaves neither the error line nor the parent-directory sequence, and that a genuine upgrade can trip it; it calls the first indicator, an over-long username next to a core dump, the crash signature of the separate CVE-2026-91843 and not evidence of this traversal (Bishop Fox, 2026-10-01). An exposed, unpatched server with neither log sign is therefore not shown to be clean. Its hunting advice is file-integrity monitoring of scheduled-task directories, startup and SSH key paths, the normally empty upgrade-tools directory, the CPM configuration files and anything new in the output-staging directory, paired with execution telemetry, cron reload events and an alert on the management Java process spawning a shell, because a scheduled hash check can miss stock files restored byte for byte (Bishop Fox, 2026-10-01). It also notes that the Trusted Clients restriction is a permissions setting that emits an implied rule, so a rule-base audit alone can miss it (Bishop Fox, 2026-10-01).

Builds on: Two pre-auth code-execution flaws sit in the certificate-processing step every VPN negotiation… · A stack overflow in Check Point's unauthenticated management login reaches root. Patch or…

vulnerability23 Sep 04:40Zmulti-sourceOpen finding →
Sources: Check Point Support (sk1000171) · Check Point Research (blog) · The Hacker News · CISA KEV · Bishop Fox · Bishop Fox (detection tool README)

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • bishopfox.com1 (17%)
  • blog.checkpoint.com1 (17%)
  • cisa.gov1 (17%)
  • github.com1 (17%)
  • support.checkpoint.com1 (17%)
  • thehackernews.com1 (17%)

External references

NVD · cve.org · CISA KEV

All cited sources (6)