Check Point Patches Exploited Management Server Zero-Day
Check Point patched exploited zero-day CVE-2026-93616 in Management Server, and CISA added it and CVE-2026-85102 to KEV.
Check Point released urgent patches for CVE-2026-93616, a CVSS 9.8 directory traversal and file-upload flaw in Management Server that lets unauthenticated attackers upload and execute arbitrary scripts. The company said a handful of customers were attacked and that the bug affects Security Management, Multi-Domain Management, Log Server, and SmartEvent products. Fixes are in the R82.20 hotfix and Jumbo Hotfix Accumulator takes for R82.10, R82, R81.20, and R81.10; LivePatch does not cover it. CISA added CVE-2026-93616 and CVE-2026-85102, a CVSS 9.8 VPN certificate-validation bug now seeing exploitation attempts against Spark firewalls, to the KEV catalog, giving federal agencies three days to patch.
- CVE-2026-93616 (CVSS 9.8) allows unauthenticated script upload and execution.
- Check Point says a handful of Management Server customers were attacked.
- Fixes are in R82.20 and Jumbo Hotfix takes for R82.10, R82, R81.20, and R81.10.
- LivePatch does not fix it; restrict TCP/19009 to trusted addresses.
- CISA KEV also lists CVE-2026-85102, now exploited against Spark firewalls.
- Vendors
- Check Point
- Organizations
- Check PointCISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85102 | Unauthenticated RCE in Check Point Quantum Security Gateway via certificate flaw | 9.8 | 54% | KEVPoC | KEV |
| CVE-2026-93616 | Unauthenticated RCE in Check Point Management Server via Directory Traversal and File Upload | 9.8 | 92% | KEVPoC | KEV |
From the original article
2 min read at securityweek.com
The critical-severity flaw could allow unauthenticated attackers to upload and execute arbitrary scripts. The post Check Point Patches Exploited Management Server Zero-Day appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.