CVE-2026-93616: 
CloudGuard Management Server vulnerability analysis and mitigation

CVE-2026-93616 is a critical pre-authentication path traversal and arbitrary file upload vulnerability in Check Point Quantum Security Management Server that allows unauthenticated remote attackers to upload and execute arbitrary scripts. Disclosed on September 22, 2026, it affects Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent across multiple versions including R82.20 (without Jumbo Hotfix), R82.10 (Jumbo Hotfix Take 44 or below), R82 (Jumbo Hotfix Take 126 or below), R81.20 (Jumbo Hotfix Take 166 or below), R81.10 (Jumbo Hotfix Take 190 or below), and all EoS versions R80 through R81. Smart-1 Cloud is not affected. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Check Point SK, GitHub Advisory, CISA KEV).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The flaw resides in the Check Point Management web service, where insufficient validation of user-supplied file paths allows an unauthenticated attacker to traverse outside the intended directory and upload arbitrary files to arbitrary locations on the server. Once uploaded, the attacker can trigger execution of the script and load an arbitrary Java class, achieving remote code execution without any credentials or user interaction. The attack is network-accessible, requires low complexity, and is fully automatable (Check Point Blog, Check Point SK). A detection script checking for indicators of compromise is publicly available on GitHub (GitHub PoC Checks).

Successful exploitation grants an unauthenticated remote attacker complete control over the Check Point Management Server, with high impact to confidentiality, integrity, and availability. Because the Management Server controls firewall policy, VPN configurations, and security rules across the entire network, compromise of this system can enable an attacker to disable security controls, exfiltrate sensitive network configuration data, pivot laterally to managed firewall appliances, and potentially facilitate ransomware deployment or large-scale network intrusion. Check Point confirmed exploitation against a handful of customers prior to public disclosure (Check Point Blog, CISA KEV).

CVE-2026-93616 is being actively exploited in the wild, with Check Point confirming a handful of targeted attacks observed as early as July 23, 2026, prior to public disclosure on September 22, 2026 (Check Point Blog). CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on September 22, 2026, with a remediation due date of September 25, 2026, and noted it requires forensic triage per BOD-26-04 (CISA KEV). The exploitation is fully automatable with no authentication or user interaction required. A public GitHub repository (WadesWeaponShed/CVE-2026-93616_Checks) provides detection/IOC-checking scripts, though no weaponized exploit code has been confirmed publicly available. The EPSS score is currently 0.0 (newly published), and no specific threat actor attribution has been publicly confirmed (GitHub Advisory).

1. Reconnaissance: Identify internet-exposed Check Point Security Management Server or Multi-Domain Security Management Server instances using tools like Shodan or Censys, targeting TCP port 19009 or the management web service interface.
2. Identify vulnerable versions: Confirm the target is running an affected version (e.g., R82.20 without Jumbo Hotfix, R82 with Jumbo Hotfix Take 126 or below, R81.20 with Jumbo Hotfix Take 166 or below, or any EoS version).
3. Craft path traversal payload: Construct an HTTP request to the Check Point Management web service endpoint that includes directory traversal sequences (e.g., ../../../../tmp/) in the file path parameter to escape the restricted upload directory.
4. Upload arbitrary script: Send the crafted request with a malicious script payload (e.g., a Python or shell script) to write the file to an attacker-controlled path on the server's filesystem.
5. Trigger script execution: Exploit the web service's ability to execute scripts from arbitrary paths or load arbitrary Java classes by referencing the uploaded file, achieving unauthenticated remote code execution as the management server process.
6. Establish persistence/lateral movement: Use the gained access to modify firewall policies, create backdoor accounts, exfiltrate network configuration data, or pivot to managed firewall appliances across the environment (Check Point SK, Check Point Blog).

• Logs: Run grep -nHP "login\(loginRequest=LoginRequest\{authenticationInfo=AuthenticationInfoBase\{username='[^' ]{1001,}'" "$MDS_FWDIR"/log/cpm.elg* — output with an unusually long username string (>1000 characters) indicates a potential exploitation attempt.
• Logs: Run grep -E "ERROR.*upgrade\.base\.ReflectionUtils.*Failed to load allResourceFiles map from" $MDS_FWDIR/log/cpm.elg* — output containing directory traversal sequences (e.g., ../../../../) in file paths indicates a potential exploitation attempt.
• File System: Presence of unexpected Python scripts or other script files in non-standard directories (e.g., /tmp/) on the Management Server, particularly those uploaded around the time of suspicious login attempts.
• File System: FWM or MDS core dump files in /var/log/dump/usermode/ generated at the same time as anomalous login attempts in cpm.elg logs.
• Network: Inbound connections to TCP port 19009 from untrusted or external IP addresses; outbound connections from the Management Server to unknown external IPs following suspicious login activity.
• Process: Unexpected child processes spawned by the management server process (e.g., Python interpreters, shell processes) not associated with normal administrative activity (Check Point SK, GitHub PoC Checks).

Check Point has released fixes: R82.20 Security Hotfix (TAR), Jumbo Hotfix Accumulator for R82.10 starting from Take 45, R82 starting from Take 127, R81.20 starting from Take 170, and R81.10 starting from Take 192. Note that LivePatch Take 28/29 does not address this issue. As an immediate workaround, restrict access to the Management Server behind a Security Gateway/Check Point Firewall and limit TCP port 19009 to trusted IP addresses only; in SmartConsole, navigate to Manage & Settings > Permissions & Administrators > Trusted Clients and restrict entries to trusted internal IPs. CISA's due date for federal agencies to remediate is September 25, 2026, and forensic triage is required per BOD-26-04 for all affected systems (Check Point SK, CISA KEV).

Check Point issued an urgent security advisory on September 22, 2026, authored by VP Research Lotem Finkelstein, urging immediate patching and confirming active exploitation prior to public disclosure (Check Point Blog). CISA added the vulnerability to its KEV catalog the same day with a 3-day remediation deadline, reflecting the severity and active exploitation (CISA KEV). Coverage from BleepingComputer, The Hacker News, SecurityWeek, Security Affairs, and GBHackers highlighted the zero-day nature and the risk to organizations with internet-exposed management servers. Community discussion on Reddit (r/checkpoint, r/pwnhub, r/SecOpsDaily) and Mastodon reflected urgency, with practitioners sharing IOC-checking scripts and patching guidance. The Canadian Centre for Cyber Security (CCCS) and New Zealand NCSC also issued advisories (Cyber.gc.ca, NZ NCSC).