Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
Check Point says attackers exploited unauthenticated Management Server zero-day CVE-2026-93616 in targeted July attacks.
Check Point said attackers exploited CVE-2026-93616, a CVSS 9.8 path-traversal flaw in Security Management Server, in a handful of targeted attacks on July 23. An unauthenticated attacker who can reach the web service can upload and run scripts. Fixes shipped September 22; earlier LivePatch takes for CVE-2026-91843 do not address it. Separately, attempts against VPN flaw CVE-2026-85102 have targeted Spark and Security Gateway customers since September 12, though success is unconfirmed.
- CVE-2026-93616 is unauthenticated path traversal, CVSS 9.8, exploited July 23.
- Affected builds include R82.20, R82.10 Take 44 and below, and older releases.
- September 16 LivePatch for CVE-2026-91843 does not fix this flaw.
- CVE-2026-85102 VPN exploitation attempts against Spark began September 12.
- IOC certificate subjects include CN=vpn, CN=vpn-user, and CN=vpnuser.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1105 Ingress Tool TransferT1059 Command and Scripting InterpreterT1046 Network Service Discovery
- Vendors
- Check Point
- Organizations
- Netherlands National Cyber Security CentreCERT Santé
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85102 | Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw | 9.8 | 54% | KEVPoC | KEV |
| CVE-2026-85103 | Unauthenticated RCE in Check Point Quantum VPN Certificate ASN.1 Decoding | 9.8 | — | ||
| CVE-2026-91843 | Unauthenticated stack overflow gives root RCE in Check Point login process | 9.8 | <1% | PoC | |
| CVE-2026-93616 | Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload | 9.8 | 92% | KEVPoC | KEV |
From the original article
4 min read at thehackernews.com
Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the company said. The flaw, CVE-2026-93616, allows an attacker who can access the server's web service to run scripts on it without logging in. Check Point released a fix on September 22 for the server that controls firewall policies for the Check Point
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.