Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
Check Point says attackers exploited unauthenticated Management Server zero-day CVE-2026-93616 in targeted July attacks.
Check Point said attackers exploited CVE-2026-93616, a CVSS 9.8 path-traversal flaw in Security Management Server, in a handful of targeted attacks on July 23. An unauthenticated attacker who can reach the web service can upload and run scripts. Fixes shipped September 22; earlier LivePatch takes for CVE-2026-91843 do not address it. Separately, attempts against VPN flaw CVE-2026-85102 have targeted Spark and Security Gateway customers since September 12, though success is unconfirmed.
88