CVE-2026-93616: 
CloudGuard Management Server vulnerability analysis and mitigation

CVE-2026-93616 is a pre-authentication directory traversal and file upload vulnerability in Check Point's Security Management Server that allows unauthenticated remote attackers to upload and execute arbitrary scripts. It was discovered and disclosed on September 22, 2026, with Check Point confirming limited in-the-wild exploitation dating back to July 23, 2026. Affected products include Check Point Quantum Security Management and Multi-Domain Security Management across versions R80 through R82.20 (with specific Jumbo Hotfix thresholds). Smart-1 Cloud and Check Point Firewall Appliances are not affected. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (Check Point SK, GitHub Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal). The flaw exists in the Check Point Management web service, where insufficient validation of user-supplied path input allows an attacker to traverse outside the intended directory structure. By crafting a malicious request, an unauthenticated attacker can upload a file to an arbitrary path and subsequently execute a script from that path, as well as load an arbitrary Java class. No authentication, user interaction, or special privileges are required, and the attack is fully network-accessible. Indicators in logs include login attempts with excessively long usernames (>1000 characters) and directory traversal sequences (e.g., ../../../../) appearing in upgrade configuration file paths in cpm.elg logs (Check Point SK, Check Point Blog).

Successful exploitation grants an unauthenticated remote attacker the ability to upload and execute arbitrary scripts on the Check Point Management Server, effectively achieving remote code execution with the privileges of the management service. This can result in full compromise of the management plane — including confidentiality, integrity, and availability impacts — enabling attackers to exfiltrate security policies, credentials, and network topology data, modify firewall rules, or disrupt security operations across all managed gateways. Given that the management server controls the entire network security infrastructure, compromise can facilitate lateral movement across the enterprise (Check Point SK, GitHub Advisory).

CVE-2026-93616 has been confirmed as actively exploited in the wild, with Check Point identifying a handful of targeted attacks as early as July 23, 2026 — approximately two months before public disclosure. The vulnerability was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on September 22, 2026 (CISA KEV). The EPSS score is approximately 19.65% (97th percentile), indicating a high probability of exploitation. A GitHub repository (WadesWeaponShed/CVE-2026-93616_Checks) provides detection/IOC-checking scripts, though no weaponized exploit code has been publicly confirmed. The vulnerability is automatable with no authentication required, making it highly accessible to threat actors (Check Point Blog, Feedly).

1. Reconnaissance: Identify internet-exposed Check Point Management Servers (Quantum Security Management or Multi-Domain Security Management) using tools like Shodan or Censys, targeting port TCP/19009 or the management web service interface.
2. Version fingerprinting: Confirm the target is running a vulnerable version (R82.20 with no Jumbo Hotfix, R82.10 Take 44 or below, R82 Take 126 or below, R81.20 Take 166 or below, R81.10 Take 190 or below, or any R80.x/R81).
3. Craft path traversal payload: Construct an HTTP request to the Check Point Management web service endpoint that includes directory traversal sequences (e.g., ../../../../tmp/) in the file path parameter, bypassing the intended restricted directory.
4. Upload malicious script: Use the traversal to write an arbitrary script (e.g., a Python or shell script) or a malicious Java class file to a writable location on the server's filesystem.
5. Trigger execution: Send a follow-up request that causes the management service to load and execute the uploaded script or Java class from the arbitrary path, achieving remote code execution as the management service account.
6. Post-exploitation: Leverage the foothold to exfiltrate security policies, pivot to managed gateways, or establish persistence on the management server (Check Point SK, Check Point Blog).

• Logs (cpm.elg): Login attempts with usernames exceeding 1000 characters — detectable via: grep -nHP "login\(loginRequest=LoginRequest\{authenticationInfo=AuthenticationInfoBase\{username='[^' ]{1001,}'" "$MDS_FWDIR"/log/cpm.elg*
• Logs (cpm.elg): Error entries referencing directory traversal sequences in upgrade configuration paths, e.g., paths containing ../../../../ — detectable via: grep -E "ERROR.*upgrade\.base\.ReflectionUtils.*Failed to load allResourceFiles map from" $MDS_FWDIR/log/cpm.elg*
• File System: Unexpected Python scripts or shell scripts in non-standard directories such as /tmp/ (e.g., paths like /opt/CPupgrade-tools-../../../../tmp/<random_dir>/scripts/upgrade_files.conf)
• File System: Presence of FWM or MDS core dump files in /var/log/dump/usermode/ generated at the same time as anomalous login attempts
• Network: Unusual unauthenticated HTTP/HTTPS requests to the management web service on port TCP/19009 from external or untrusted IP addresses
• Process: Unexpected script execution (Python, shell) spawned by the management service process (Check Point SK)

Check Point has released patches addressing CVE-2026-93616. Apply the following fixes immediately:

• R82.20: Install the R82.20 Security Hotfix (TAR)
• R82.10: Upgrade to Jumbo Hotfix Take 45 or later
• R82: Upgrade to Jumbo Hotfix Take 127 or later
• R81.20: Upgrade to Jumbo Hotfix Take 170 or later
• R81.10 (EoS): Upgrade to Jumbo Hotfix Take 192 or later
• R80.x / R81 (EoS): Upgrade to a supported version immediately

Note: LivePatch Take 28/29 does not address this issue. As a network-level workaround, restrict access to port TCP/19009 to trusted IP addresses only, and place the Management Server behind a Check Point Security Gateway with implied rules limiting Trusted Clients to internal addresses via SmartConsole (Manage & Settings > Permissions & Administrators > Trusted Clients) (Check Point SK, Check Point Blog).

Check Point issued an urgent security advisory on September 22, 2026, signed by VP Research Lotem Finkelstein, urging immediate patching and confirming active exploitation (Check Point Blog). CISA added the vulnerability to its KEV catalog the same day, setting a federal remediation deadline (CISA KEV). Coverage was widespread across major security outlets including BleepingComputer, The Hacker News, SecurityWeek, and eSecurity Planet, with community discussion active on Reddit, Mastodon, and Bluesky. Government CERTs from Canada (CCCS), Belgium (CCB), New Zealand (NCSC), and the UK (NHS Digital) issued independent advisories. Security researchers noted the unusual two-month gap between initial exploitation (July 23) and public disclosure, with some commentary highlighting the risk of management plane exposure to the internet (BleepingComputer, The Hacker News).