Hackers Exploit Check Point 0-Day Flaw to Execute Code on Management Servers
Check Point says CVE-2026-93616 is exploited to run code on unauthenticated management servers.
Check Point disclosed CVE-2026-93616, a CVSS 9.8 directory-traversal and arbitrary file-upload flaw that lets unauthenticated attackers upload and execute scripts on exposed management servers. Affected products include Security Management Server, Multi-Domain Security Management, Log Server, Multi-Domain Log Server, and SmartEvent; Smart-1 Cloud and firewall appliances are not affected. Check Point said a handful of customer environments were already attacked. Fixes are in an R82.20 security hotfix and jumbo takes R82.10 Take 45, R82 Take 127, R81.20 Take 170, and R81.10 Take 192. LivePatch does not remediate the issue.
- CVE-2026-93616 scores CVSS 9.8 and is actively exploited
- Unauthenticated attackers can upload and execute scripts on management servers
- Check Point says a handful of customer environments were attacked
- Fixes are in an R82.20 hotfix and specified jumbo takes
- LivePatch does not remediate it; restrict TCP/19009
- CVEs
- CVE-2026-93616
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-93616 | Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload | 9.8 | 92% | KEVPoC | KEV |
From the original article
2 min read at gbhackers.com
Check Point has issued an urgent security alert about CVE-2026-93616, a critical vulnerability involving directory traversal and arbitrary file uploads. This issue affects multiple management-server products and is actively being exploited in the wild. It allows unauthenticated attackers to upload and execute arbitrary scripts on exposed Check Point Management Servers.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.