Check Point Fixes a New Actively Exploited Critical Security Flaw
Check Point issued emergency hotfixes for actively exploited critical path traversal CVE-2026-93616 in Security Management Server.
Check Point released emergency hotfixes (R82.20 Security Hotfix) for CVE-2026-93616, a critical unauthenticated path traversal flaw allowing attackers to upload and execute malicious scripts on Security Management Servers, and confirmed exploitation in the wild against a handful of customers. Affected products include Security Management Server, Multi-Domain Security Management, Log Server, Multi-Domain Log Server, and SmartEvent, with IOCs published in the advisory. The flaw follows two earlier critical Check Point issues: CVE-2026-16232 (actively exploited auth bypass) and the Dutch NCSC warning covering CVE-2026-85102 and CVE-2026-85103.
- CVE-2026-93616 allows unauthenticated script upload and execution
- Exploitation in the wild confirmed against handful of customers
- Fixed in R82.20 Security Hotfix; IOCs published
- Affects SMS, MDSM, Log Servers, and SmartEvent
- Third critical Check Point flaw disclosed within two months
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1105 Ingress Tool TransferT1059 Command and Scripting Interpreter
- Organizations
- Check PointDutch National Cyber Security Centre
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-16232 | Authentication Bypass in Check Point SmartConsole Grants Full Admin Access | 9.3 | 4% | KEV | KEV |
| CVE-2026-85102 | Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw | 9.8 | 54% | KEVPoC | KEV |
| CVE-2026-85103 | Unauthenticated RCE in Check Point Quantum VPN Certificate ASN.1 Decoding | 9.8 | — | ||
| CVE-2026-93616 | Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload | 9.8 | 92% | KEVPoC | KEV |
From the original article
2 min read at securityaffairs.com
Check Point fixes an actively exploited flaw that lets unauthenticated attackers upload and run scripts on vulnerable Security Management Servers. Check Point has released emergency hotfixes for CVE-2026-93616, a critical path traversal flaw in its Security Management Server. The security firm bug is already being exploited.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.