Check Point Fixes Exploited Management Server Zero-Day

Check Point has released a fix for a previously unknown zero-day vulnerability in its Security Management Server after attackers used it in a small number of targeted attacks on July 23. The flaw, identified as CVE-2026-93616, is a path traversal bug in the server's web service. Path traversal means the web service does not properly limit which files and folders a request can reach. An attacker who can access that service can therefore upload scripts to the server and then run them without logging in. Check Point rated the issue 9.8 out of 10 on the CVSS scale, where CVSS stands for Common Vulnerability Scoring System and 10 is the most severe. The fix was published on September 22 for the Security Management Server, the system that controls firewall policies for the Check Point gateways it manages. Check Point's advisory does not name the targets of the July attacks or the attackers, and it does not say what the attackers did after exploiting the flaw.

The affected versions listed in the CVE record show that many older and current releases need attention. Check Point numbers its Jumbo Hotfix updates for each release by a number called a 'Take.' Its LivePatch channel, which pushes urgent fixes, uses a separate set of take numbers. The CVE record lists these versions as affected: R82.20 with no Jumbo Hotfix installed, R82.10 with Jumbo Hotfix Take 44 or below, R82 with Jumbo Hotfix Take 126 or below, R81.20 with Jumbo Hotfix Take 166 or below, and R81.10 with Jumbo Hotfix Take 190 or below, which is end of support. The releases R81, R80.40, R80.30, R80.20, R80.10 and R80 are all end of support and are also listed as affected. Check Point's advisory lists R82.20 as affected without the 'no Jumbo Hotfix' condition. On September 16, Check Point fixed a separate management server flaw, CVE-2026-91843, through LivePatch. France's CERT Santé summarized that update as LivePatch Take 28, or Take 29 on R82.20, and Check Point says those LivePatch takes do not fix CVE-2026-93616. A related VPN certificate flaw fixed on September 9, CVE-2026-85103, affected both gateways and management servers. For R82.10, R82, and R81.20, the new flaw's affected version list goes one take higher than that September flaw's list, so a server updated only enough to fall outside that earlier flaw's range is still affected by CVE-2026-93616. The fixed builds, and Check Point's guidance on mitigation, hunting, and indicators of compromise, are in support article sk1000171. Administrators should check the server's release and Jumbo Hotfix take against the list, install the fix, and then use the hunting guidance and indicators of compromise to look for signs of an attack. Installing the fix does not show whether the server was attacked before.

Check Point also said that attackers have been trying since September 12 to exploit a separate VPN flaw it fixed on September 9. VPN stands for virtual private network, and the flaw, CVE-2026-85102, is in the way Check Point gateways check digital certificates while a VPN connection is being set up. A certificate is an electronic document that proves identity. The flaw may let an attacker who has not logged in run code on the gateway. The affected products are Security Gateway and Spark firewalls, whether centrally or locally managed, on R81 and R81.10, both end of support, R81.10.x, R81.20, R82, R82.00.x and R82.10. The Netherlands National Cyber Security Centre (NCSC) says the flaw applies when these products use Site-to-Site VPN or Remote Access VPN. Check Point said the attempts came from anonymizing infrastructure, including VPN services and proxies, and used certificates with these subjects: CN=vpn,OU=users,O=global; CN=vpn-user,OU=users,O=global; and CN=vpnuser,OU=users,O=global. The list is not complete, and other subjects may be in use. Administrators should check logs for any unusual certificate-based Mobile Access login, not only those with these subjects. They should also check what suspicious Mobile Access users do after logging in, which often includes scanning internal ports and services. When the September 9 fix was released, Check Point had no evidence that this VPN flaw was being exploited. Check Point says customers who installed the September 9 fix are protected, but its advisory does not say whether any attempt succeeded. For gateways that cannot be patched yet, the NCSC lists a Check Point workaround for Site-to-Site VPN: turn off the implied VPN rules and allow UDP ports 500 and 4500 only from specific peer IP addresses. The workaround does not apply to locally managed Spark firewalls. Mitigation steps from Check Point are in support article sk1000117.

For Check Point customers, these two advisories create a clear set of priorities. The management server flaw is more severe because it was already exploited in the wild, while the VPN flaw affects a different set of products and has only been seen in attempted exploitation so far, with no reported success in Check Point's advisory. Teams that manage Check Point gateways should treat the management server fix as urgent and apply it to every release listed as affected, including older end-of-support systems if they remain in use. Because the July attackers uploaded and ran scripts after bypassing authentication, simply installing the patch is not enough. Administrators also need to search for signs that the server was already compromised, using the hunting guidance and indicators of compromise in support article sk1000171. For the VPN flaw, checking logs for unusual certificate-based Mobile Access logins and unusual post-login activity, such as scanning internal ports and services, is the first detection step. End-of-support releases pose an extra risk because they may not receive routine fixes; even though they are listed, organisations should plan to move off them.

For website owners and businesses that rely on Check Point firewalls or VPNs, the practical takeaway is to verify the exact software version and hotfix take on each device, apply the available fixes, and limit remote access to management interfaces. Check Point's advisory names only Security Management Server as affected by CVE-2026-93616 and does not say what network access an attacker needs, while The Hacker News has asked Check Point about other affected products, the fixed builds, and the July attacks. For teams that need to move quickly from a vendor advisory to a tested rollout, AEU-I, a security-first IT, infrastructure and consulting service, can help review patch and mitigation processes so an urgent Check Point fix is not left unapplied. This is reporting on Check Point's disclosure and the public advisories, not a claim that AEU-I detected or fixed the flaw.