Hackers Exploit Check Point 0-Day Flaw to Execute Code on Management Servers

Check Point has issued an urgent security alert about CVE-2026-93616, a critical vulnerability involving directory traversal and arbitrary file uploads. This issue affects multiple management-server products and is actively being exploited in the wild.

It allows unauthenticated attackers to upload and execute arbitrary scripts on exposed Check Point Management Servers.

The vulnerability has a CVSS score of 9.8. It impacts the following products: Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent deployments.

Check Point has reported that they are aware of a “handful” of customer environments that have already been attacked.

Overview of the Vulnerability

Tracked as CVE-2026-93616, this vulnerability arises from a combination of directory traversal and file-upload weaknesses. An unauthenticated remote attacker could manipulate file paths, upload malicious content, and execute arbitrary scripts on the management infrastructure.

Management servers are high-value targets because they centrally manage security policies, gateways, logs, domains, and operational configurations.

If compromised, attackers could alter configurations, deploy malicious policy changes, access sensitive logs, or penetrate deeper into enterprise environments.

Identification of Affected Versions

Check Point identified the following vulnerable releases:

Smart-1 Cloud is not affected, as the fix has already been deployed. Check Point Firewall Appliances and Check Point Spark Firewall products are also not impacted.

Administrators should immediately inspect Security Management, Multi-Domain Security Management, Log, Multi-Domain Log, and SmartEvent servers for indicators of compromise. One detection method involves searching the `cpm.elg` logs for unusually long usernames in SmartConsole login requests:

grep -nHP "login\(loginRequest=LoginRequest\{authenticationInfo=AuthenticationInfoBase\{username='[^' ]{1001,}'" "$MDS_FWDIR"/log/cpm.elg*

If this command produces results, administrators should check for any `fwm` or `mds` core dumps created around the same time:

ls -l /var/log/dump/usermode/ | grep -e fwm -e mds

A corresponding core dump may indicate a potential exploitation attempt. Additionally, teams should search logs for failed resource-file loads that include traversal strings such as `../`:

grep -E "ERROR.*upgrade\.base\.ReflectionUtils.*Failed to load allResourceFiles map from" $MDS_FWDIR/log/cpm.elg*

Check Point has released an R82.20 Security Hotfix and incorporated fixes into Jumbo Hotfix Accumulators: R82.10 Take 45, R82 Take 127, R81.20 Take 170, and R81.10 Take 192.

Note that LivePatch Take 28/29 does not remediate this issue, and no further LivePatch will be available due to the nature of the fix.

Organizations should restrict TCP/19009 access to trusted internal IP addresses, place Management Servers behind a Security Gateway or Check Point Firewall, and review SmartConsole Trusted Clients settings.

Security teams should prioritize patching internet-accessible or remotely administered management servers, review logs for signs of exploitation, and rotate privileged credentials if they suspect a compromise.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC