Active Exploitation
🔥 CyberForge CVE of the Day #059
🚨 CVE-2026-93616 — Check Point Security Management: pre-authentication path traversal to script execution
Check Point describes attacks on 23 July. The public advisory and fixes arrived on 22 September. That gap matters for every server reachable before the patch.
A Management web-service flaw lets an unauthenticated attacker upload and execute scripts. Check Point also describes arbitrary-path script execution and Java class loading. No login or click is required.
CVSS v3.1: 9.8 Critical. CISA added the CVE to its Known Exploited Vulnerabilities catalogue on the day of disclosure.
⚠️ Treat this as an urgent management-server patch and a separate look back at historical exposure.
🎯 The quick hit:
🔹 Affected: Security Management and related roles, including standalone appliances that run management.
🔹 Boundary: untrusted path/file input reaches a service before login.
🔹 Result: script execution and possible Java class loading.
🔹 Evidence: vendor-observed July attacks; CISA KEV listing.
🔹 Action: restrict access, apply the correct take and investigate past exposure.
🔑 Key details:
⭐ Severity: Critical
📊 CVSS v3.1: 9.8 — Check Point CNA assessment
🧮 Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
🧠 Weakness: CWE-22 — Path Traversal
🎯 Targets: Security Management; related management/logging roles below
🧩 Vulnerable boundary: untrusted path/file input → management web service
🌐 Attack vector: Network; exposure varies
⚙️ Attack complexity: Low
🔓 Privileges required: None
👆 User interaction: None
🔀 Scope: Unchanged in CVSS v3.1
⚔️ Impact: arbitrary-script execution and Java class loading
💥 CVSS impact: High confidentiality, integrity and availability impact
👤 Execution context: management host; precise privileges unverified
🛡️ Fix: branch-specific hotfix; exact takes below
🔑 Additional remediation: exposure review; recovery if needed
🚨 Active exploitation: Yes — vendor-observed attacks and CISA KEV
🧪 Reproduction: no complete public PoC independently validated; no exploit run
📋 CISA KEV: Added 22 September 2026; listed due 25 September for applicable federal owners
📉 EPSS: no entry as of 23 September; not 0%
🗓️ Vendor-observed attacks: 23 July 2026
🩹 Vendor fixes: 22 September; take matrix below
📜 Vendor bulletin: sk1000171 (support access may be required)
🔬 Campaign detail: a handful of pinpointed attacks; no complete public chain
No CVSS v4.0 score was found. NVD is Awaiting Analysis; its 9.8 is vendor-sourced.
🧬 What actually went wrong?
A management web service should confine file operations to authorised locations. Here, that boundary can be crossed before authentication.
1️⃣ Untrusted input reaches management
An attacker needs network reachability, not a password. CVSS Network does not imply universal internet exposure.
2️⃣ Path validation fails
CWE-22 means a path can escape its permitted directory. The CNA connects this to file upload; the exact route, parameter and internal function were not disclosed in the reviewed public material.
3️⃣ The service executes attacker-controlled content
The CNA says scripts can be uploaded and executed. Check Point adds arbitrary-path execution and Java class loading. The July attackers’ exact sequence remains undisclosed.
The remedy is the vendor fix plus restricted access. No exploit payload or guessed endpoint is included.
🧭 Management function matters more than the box label.
Check Point says Quantum Force and Quantum Spark *firewall-only* devices are not affected by this management CVE. A standalone firewall that also hosts management is affected, an administrator clarified.
Smart-1 Cloud is already patched, per Check Point. CISA additionally lists SmartEvent, absent from the short vendor notice; include it in inventory and confirm applicability with support.
The same blog covers CVE-2026-85102, a separate Gateway VPN-certificate flaw. Its Spark scope, certificate indicators and September 12 attack date do not belong here.
⚔️ The practical attack chain:
This outlines capability, not a disclosed step-by-step account of the July attacks.
1️⃣ An affected management service is reachable.
2️⃣ Unauthenticated input reaches its file/path handling; exact route and parameter are unknown.
3️⃣ Path restrictions fail; the CNA describes an upload-and-execute outcome, with exact order unpublished.
4️⃣ A script executes; Check Point also describes Java class loading.
5️⃣ Investigators assess actual host access and follow-on activity.
The first four points reflect vendor/CNA capability; step five is CyberForge triage. Neither policy tampering nor gateway compromise is established.
👤 Execution context — what the attacker actually gets.
Code execution on Security Management is serious. Public sources do not establish the exact service user, root access or a victim’s available permissions.
Assess policy revisions, administrators, secrets, logs and connected gateways according to local privileges and evidence. These are investigation areas, not reported actions by the July attackers.
Use independent host, network, identity and change records to determine whether any capability was used.
📦 Affected products and versions.
The CNA names Quantum Security Management. Check Point lists Security Management Server, Multi-Domain Management Server, Log Server and Multi-Domain Log Server. CISA also lists SmartEvent; confirm its applicability with support.
Affected range → vendor-announced fixed take:
🔹 R82.20: R82.20 without Jumbo Hotfix → Security Hot Fix Take 1.
🔹 R82.10: Jumbo Hotfix Take 44 or lower → JHF Take 45.
🔹 R82: Jumbo Hotfix Take 126 or lower → JHF Take 127.
🔹 R81.20: Jumbo Hotfix Take 166 or lower → JHF Take 170.
🔹 R81.10 (end of support): Jumbo Hotfix Take 190 or lower → JHF Take 192, or vendor-supported upgrade.
🔹 R81 and R80.40/R80.30/R80.20/R80.10/R80 (end of support): listed as affected; obtain a supported migration or replacement route from Check Point.
Version trap: the public cutoff does not establish whether intermediate R81.20 Takes 167–169 or R81.10 Take 191 are fixed. Install the named fixed take or seek vendor confirmation.
R82.20 takes a Security Hot Fix. LivePatch Takes 28/29 do not fix this CVE. Verify the running take, not a downloaded package.
Include virtual, standalone, logging, secondary and disaster-recovery management systems; record each role and take.
🕰️ Timeline / exploitation window.
🔴 23 July 2026: Check Point reports pinpointed attacks. This observed date is not necessarily the first or last attack.
🔎 18 September: CVE reserved; an administrative date, not an attack timestamp.
🟢 22 September: advisory, fixes, CVE publication and CISA KEV addition.
🔎 23 September: CyberForge source checks.
📅 25 September: CISA KEV due date for applicable federal owners; an urgency signal elsewhere.
Hunt beyond July 23. Reconstruct past reachability and log coverage until the fix. Exposure warrants triage; it does not prove compromise.
👁️ Defender hunting guide:
These are CyberForge hypotheses, not exploit signatures. Use sk1000171 for official IOCs and supported collection.
1️⃣ Reconstruct exposure and version history
Record role, exact take, management IP, patch time, peers and standalone status. Join historical upstream rules, NAT, VPN, allowlists and support access around 23 July and afterward.
A current rule cannot prove July reachability. Preserve event-time IP ownership and timezone.
2️⃣ Review management traffic in context
Check web-service, proxy, firewall and flow logs for unfamiliar sources, unauthenticated requests and upload events. Correlate requests with later host activity.
Check Point recommends restricting TCP 19009 to trusted IPs. That is an access-control action; do not assert every exploit request always used 19009 without evidence from the actual deployment or vendor article. An encrypted flow may show a connection while hiding HTTP content.
3️⃣ Inspect the management host using supported procedures
Look for newly written executable content, unexpected scripts or classes, web-service-linked process starts, altered service startup settings and unexplained outbound communication. Record file hashes, owner, creation/change times, process parent and connection details where available.
These are investigation pivots, not July IOCs. Preserve suspicious artefacts before removal.
4️⃣ Check management integrity and connected scope
Compare policy revisions, administrators and logging destinations with independent baselines and change tickets. If compromised, assess secrets and gateways actually reachable from that instance.
Cross-check against upstream firewall logs and independent backups. A suspect management/log server may be incomplete evidence about itself.
5️⃣ State the visibility limit honestly
Write down search terms, time ranges, retention, logging gaps and whether sk1000171 IOCs were actually available. “No suspicious events in retained firewall flows; July application logs absent” is a meaningful bounded finding. Missing logs cannot support an unqualified “clean” verdict.
🩹 Emergency remediation order:
1️⃣ Reduce reachability and preserve evidence
Limit management TCP 19009 to trusted sources as Check Point advises, and review other management paths in the local topology. Preserve external access logs, configuration, running-build details and host evidence where safe. Do not delay containment of an active incident for perfect collection.
2️⃣ Choose the exact vendor fix
Match each asset’s branch, role and installed take to the matrix above and Check Point’s detailed sk1000171. Obtain the approved package from official channels. For end-of-support trains, get a supported upgrade/replacement plan; an unlisted take is not a safe assumption.
3️⃣ Install, restart as directed and verify the running take
Coordinate Multi-Domain, HA, logging and standalone dependencies. Follow the vendor’s compatibility and maintenance order. No public verification command was reproduced here because the detailed support article was unavailable; use the vendor’s actual supported procedure. Check management and log functions after the change.
4️⃣ Hunt the historical window
Review July-era exposure, possible attacker activity and the time through patch. Record what telemetry was present, what was checked and what remains unknown. Keep this open even after the patch ticket is closed.
5️⃣ Recover and rotate according to evidence
If compromise is confirmed or host integrity cannot be bounded, involve Check Point and incident response in a supported recovery from known-good media/configuration. Rotate or revoke secrets actually exposed from a trusted system after containment; assess downstream access rather than presuming universal credential loss.
6️⃣ Validate and monitor
Record a running fixed take and access restriction for every relevant member. Verify policy installation and log collection. Watch for renewed unauthorised access or reuse of exposed credentials.
🧱 Temporary exposure reduction.
✅ Limit TCP 19009 to a small set of approved administrator IPs, as Check Point recommends.
✅ Review upstream rules, VPN paths, NAT, remote-support access and any management interface with reachability to affected roles.
✅ Include standalone devices that run both gateway and management functions.
✅ Maintain trusted external logging and preserve a supported recovery path while restricting access.
✅ Use the vendor’s detailed mitigation guidance if a fix cannot be installed immediately.
These controls reduce the reachable attack surface. They do not replace the hotfix or establish that a previously reachable server was never compromised.
🚑 When vulnerability management becomes incident response.
Escalate for investigation when you see:
🔴 Historical access from an unauthorised source while an affected take ran.
🔴 Vendor-published IOC matches confirmed with context.
🔴 Suspicious management requests followed by unexplained scripts, classes or process activity.
🔴 Unapproved administrator or policy changes, altered logging or unusual egress.
🔴 Evidence of secrets being used from unfamiliar systems or locations.
🔴 Significant July-era exposure with insufficient records to establish integrity.
Plan containment around critical management and logging dependencies. A vulnerable build alone does not prove theft, persistence, ransomware or downstream gateway compromise; a patched build alone does not clear historical activity.
📊 CISA KEV and EPSS context.
Checked 23 September 2026:
🔹 CISA KEV: CVE-2026-93616 added 22 September, due 25 September for applicable owners; forensic triage Yes; ransomware use Unknown.
🔹 FIRST EPSS API: `total: 0`, with no dated score or percentile for this CVE.
An absent EPSS row is missing model data, not a 0% probability. The known attacks and KEV inclusion are stronger operational signals. Follow the applicable CISA requirements if they govern your organisation.
🧾 Evidence separation.
Vendor-confirmed: affected Management web service, pre-authentication path traversal, script execution/Java class loading, July 23 observed attacks, patch availability, exact named hotfixes and TCP 19009 access restriction.
CNA / government records: CVSS v3.1 9.8, CWE-22 and affected branch ranges from the Check Point CNA; CISA’s known-exploited listing and its dates/triage field. NVD currently attributes its score to Check Point.
CyberForge interpretation: exposure priorities, host and policy hunting, execution-context questions, recovery ordering and incident escalation. These are practical analysis, not published details of July victim systems.
Not established: exact exploit endpoint, parameter, payload, full IOCs, a verified complete public PoC, runtime privilege level, persistence, data theft, full victim count or compromise of every gateway managed by a vulnerable server.
No exploit was executed. The full sk1000171 support article was not independently accessible during this review.
🔥 CyberForge verdict:
CVE-2026-93616 is a Critical, actively exploited route into central security management with a clear vendor patch path and a historical triage question that patching cannot settle.
Prioritise any reachable affected system, including standalone management/gateway devices and secondary management roles. Use exact running takes, actual network paths and evidence from the July window to decide what happened locally.
The response sequence is:
1️⃣ Restrict access and preserve useful evidence.
2️⃣ Install the branch-specific fixed take; verify the running result.
3️⃣ Hunt the period of vulnerable reachability.
4️⃣ Scope and rotate exposed secrets when indicated.
5️⃣ Recover from a trusted state if compromise is confirmed or integrity remains unbounded.
6️⃣ Monitor management activity and connected systems for follow-on abuse.
The CyberForge verdict: patch the control room, then find out who could enter it before the lock was changed.
🔗 Check Point advisory and July attack statement:
https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/
🔗 Check Point fixed takes, access restriction and standalone clarification:
https://community.checkpoint.com/t5/General-Topics/Action-required-Critical-Vulnerability-CVE-2026-93616-in-Check/td-p/282631
🔗 Detailed vendor guidance and IOCs (support access may be required):
https://support.checkpoint.com/results/sk/sk1000171/
🔗 CVE record:
https://www.cve.org/CVERecord?id=CVE-2026-93616
🔗 NVD vulnerability record:
https://nvd.nist.gov/vuln/detail/CVE-2026-93616
🔗 CISA KEV official data:
https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json
🔗 FIRST EPSS query:
https://api.first.org/data/v1/epss?cve=CVE-2026-93616
#CyberSecurity #CVE #CheckPoint #ManagementPlane #PathTraversal #ThreatHunting #IncidentResponse #CyberForge
Post summary
CVE‑2026‑93616 is a critical, actively exploited pre‑authentication path‑traversal flaw in Check Point Management with a vendor hotfix and CISA KEV listing, requiring urgent patching and mitigation.
