Check Point Multi-Domain Security Management Server

CVE-2026-93616, Check Point Security Management: pre-authentication path traversal to arbitrary script execution, exploited as a zero-day, with attacks observed on 2026-07-23 (CVSS 9.8)

Check Point discloses a pre-authentication directory-traversal and file-upload vulnerability that lets an unauthenticated attacker upload and execute arbitrary scripts on the Check Point Management Server (Check Point Support, sk1000171, 2026-09-22), which in Check Point Research's words "allows an attacker to execute a script from an arbitrary path and load an arbitrary Java class" (Check Point Research, 2026-09-22). It affects Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent; Smart-1 Cloud already carries the fix, and Security Gateway appliances and Spark Firewall are not affected (Check Point Support, sk1000171, 2026-09-22). Check Point states it identified "a handful of pinpointed attacks" exploiting this as a zero-day on 2026-07-23 (Check Point Research, 2026-09-22), roughly two months before the 2026-09-22 disclosure and fix. Affected versions: R82.20 without the Security Hotfix or Jumbo Hotfix Take 10, R82.10 Jumbo Hotfix Take 44 or lower, R82 Take 126 or lower, R81.20 Take 166 or lower, R81.10 Take 190 or lower (end-of-support), and the end-of-support R80/R80.10–R80.40/R81 lines (Check Point Support, sk1000171, 2026-09-22). Fixed in the R82.20 Security Hotfix or Jumbo Hotfix Accumulator R82.20 Take 10+, R82.10 Take 45+ / R82 Take 127+ / R81.20 Take 170+ / R81.10 Take 192+; sk1000171 lists no fix for the end-of-support R80 through R81 lines (Check Point Support, sk1000171, 2026-09-22). Check Point states plainly "because of the nature of the fix, a LivePatch is not be available for this issue" (Check Point Support, sk1000171, 2026-09-22); the September LivePatch (Take 28/29) that addressed the unrelated CVE-2026-91843 flaw does not cover this vulnerability (The Hacker News, 2026-09-22). CISA added it to KEV the same day (CISA KEV, catalogue version 2026.09.22). This is a distinct, unrelated flaw from CVE-2026-85102 (a separate Check Point Security Gateway/Spark VPN certificate-validation RCE, disclosed 2026-09-09, with exploitation attempts reported from 2026-09-12 (Check Point Research, 2026-09-22)), with different components and no CVE overlap.

Detection concept: Check Point's sk1000171, revised on 2026-10-13, lists four indicators in the management-process log (cpm.elg): one for the authentication bypass, a login whose username field exceeds 1,000 characters with a management-process core dump written at the same moment, and three for an attacker already past authentication: a suspicious version path in an Invoking method ... in version: log line, which Check Point's search matches on dots, slashes, backslashes and their URL-encoded forms, an upload path carrying directory traversal toward the upgrade-tools files, and a JAR path that breaks out of the expected upgrade-tools directory (Check Point Support, sk1000171, 2026-09-22). Bishop Fox said on 2026-10-01 that its route to root never trips the upgrade-tools load-error indicator Check Point then listed, since that route writes a scheduled-task file and never calls the upgrade service (Bishop Fox, 2026-10-01); the revised sk1000171 no longer lists that indicator (Check Point Support, sk1000171, 2026-09-22); neither Check Point nor Bishop Fox states whether the three new indicators catch that route, so file-integrity checks remain the test that does not depend on them. Triage: Check Point treats the over-long username paired with a simultaneous core dump as a possible attempt on this flaw's authentication bypass (Check Point Support, sk1000171, 2026-09-22), while Bishop Fox calls the same pairing the crash signature of the separate CVE-2026-91843, which the same hotfix fixes, and not evidence of this traversal (Bishop Fox, 2026-10-01); an over-long username without a matching core dump does not meet Check Point's indicator. Hardening: because no LivePatch exists, restrict network reachability to the management web service (Check Point names TCP/19009 specifically) to trusted administrative IP ranges via the platform's Trusted Clients or implied-rule mechanism, which Bishop Fox calls Check Point's primary mitigation (Bishop Fox, 2026-10-01).

Builds on: Two pre-auth code-execution flaws sit in the certificate-processing step every VPN negotiation… · A stack overflow in Check Point's unauthenticated management login reaches root. Patch or…

CVE-2026-91843, Check Point Security Management / Multi-Domain Security Management / Log Server: unauthenticated stack overflow in the login process reaches root RCE (CVSS 9.8)

Check Point disclosed CVE-2026-91843 (CVSS 9.8) on 2026-09-16: a stack overflow in the unauthenticated login process to Check Point Security Management Server, Multi-Domain Security Management Server, Log Server and Multi-Domain Log Server lets an attacker who reaches the login interface run arbitrary code remotely as root (Check Point PSIRT, 2026-09-16). Check Point's attack indicator is a failed administrator login for an over-long username (Check Point PSIRT, 2026-09-16). Neither Check Point's advisory nor CERT-FR reports observed exploitation (Check Point PSIRT, 2026-09-16 · CERT-FR CERTFR-2026-AVI-1193, 2026-09-17).

Check Point ships the fix as a LivePatch: administrators with automatic updates enabled per sk175504 are already protected, and cplp list in Expert mode should show the CVE-2026-91843 patch armed on R82.20, R82.10, R82 and R81.20 (Check Point PSIRT, 2026-09-16). The fix is also in the Jumbo Hotfix Accumulator for R82.20 from Take 10, R82.10 from Take 45, R82 from Take 127, R81.20 from Take 170 and the end-of-support R81.10 from Take 192, while Check Point lists no fix for R80.x and R81 (Check Point PSIRT, 2026-09-16). Check Point's mitigation is to limit Trusted Clients (GUI clients) to trusted IP addresses or subnets and never to use "Any" as the client type (Check Point PSIRT, 2026-09-16). The flaw needs no credentials and yields root (Check Point PSIRT, 2026-09-16), so the absence of exploitation reports does not lower the urgency.

Triage: Check Point's advisory for CVE-2026-93616 treats a login with a username over 1,000 characters that coincides with an FWM or MDS core dump as a potential attempt to exploit that flaw (Check Point Support, sk1000171, 2026-09-20). For CVE-2026-91843, Check Point gives only the "Username too long" login failure as its attack indicator (Check Point PSIRT, 2026-09-16).

Builds on: Check Point patches a management-server zero-day it says has already been used in a handful of…

CVE-2026-18574, Check Point Security Management: unauthenticated bypass of management authentication to arbitrary command execution, with no fix for seven end-of-support trains

Check Point disclosed CVE-2026-18574 in support article sk185222, created 2026-08-01 and last modified 2026-08-03: an unauthenticated attacker may be able to bypass management authentication and execute arbitrary commands on the Security Management Server, with successful exploitation resulting in full compromise of the management system (Check Point, 2026-08-03). CERT-FR issued CERTFR-2026-AVI-0965 on 2026-08-04, describing the effect as remote arbitrary code execution together with a security-policy bypass (CERT-FR, 2026-08-04), and BSI CERT-Bund published WID-SEC-2026-2628 the same day (BSI CERT-Bund, 2026-08-04). No party has published a CVSS score; Check Point rates the advisory High.

The affected product is the estate's policy authority, not an edge device. A Security Management or Multi-Domain Management Server holds the policy database, the object database, administrator accounts and the SIC trust material for every gateway it manages, so command execution there is a whole-perimeter problem rather than a single-host one. The single stated precondition is reachability: Check Point's advisory records that successful exploitation requires network access to the Security Management Server, and that environments which do not restrict Trusted Clients, or which expose management services to untrusted networks, may have increased exposure (Check Point, 2026-08-03).

The end-of-support gap is the sharpest fact here. Check Point's fix list covers three trains (Jumbo Hotfix Accumulator Take 161 on R81.20, Take 122 on R82, Take 40 on R82.10) while its affected-versions list additionally names R80, R80.10, R80.20, R80.30, R80.40, R81 and R81.10, all marked end-of-support (Check Point, 2026-08-03). For an estate still running any of those, there is no patch to apply and no vendor fix coming; the answer is an upgrade programme or network containment, and containment is the only one available this week. Smart-1 Cloud customers are stated to be already protected.

Check Point states the issue was discovered internally and that it has no indication of active exploits (Check Point, 2026-08-03). That is the vendor's assessment as of 2026-08-03 and is worth weighing against this product surface's recent record rather than reading as a grace period: CVE-2026-16232, an authentication bypass in the SmartConsole login path on the same management servers, went from disclosure to confirmed in-the-wild exploitation and a CISA KEV listing within days in July, and its root cause turned out to be a caller-supplied identity value the server trusted, on a configuration that was the default in testing. Two further CVEs in the same bundle followed a week later, an unauthenticated command-execution flaw and a Gaia Portal privilege escalation. Counting those, this is the fourth CVE on this management surface in roughly two weeks and the second authentication bypass among them.

Detection concepts, telemetry class first. Management-plane authentication logs are the primary surface: successful administrative sessions on the management server that are not preceded by a matching client authentication, sessions whose source address sits outside the Trusted Clients definition, and policy-install, object-modification or administrator-creation events that do not correlate with a preceding interactive administrator login. Because this flaw reaches command execution, host process-creation telemetry on the management server itself is the second anchor; shells or interpreters spawned by the management daemons are not part of normal operation.

Triage: legitimate automation produces administrative API activity without an interactive login too, CI-driven policy pushes, configuration-management integrations and scheduled management jobs all look like that. The discriminators are the source address measured against the Trusted Clients definition, which API identity is in use, and whether the activity falls inside a known scheduled window; all three should be a small fixed set on a healthy management network.

Builds on: Check Point patches an actively-exploited SmartConsole authentication bypass granting full…