CVE-2026-93616(checkpoint / multi-domain_security_management)

‼️ Check Point is warning customers about a newly disclosed Security Management Server zero-day exploited in targeted attacks in July. CVE-2026-93616 lets an attacker who can reach the web service upload and run scripts without logging in. A fix landed Sept. 22. Here's what admins should hunt for: https://thehackernews.com/2026/09/check-point-warns-of-management-server.html

Security Advisory – Action Required – Active Exploitation of CVE-2026-85102 and a Management Pre-Authentication Vulnerability CVE-2026-93616 https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/

🚨 Check Point patches Management Server zero-day exploited in attacks ⠀ Check Point has released fixes for CVE-2026-93616, a vulnerability that allows unauthenticated attackers to upload and execute arbitrary scripts on affected management servers. ⠀ The company says a small number of customers have already been attacked. ⠀ Affected products include: • Security Management Server • Multi-Domain Security Management Server • Log Server • Multi-Domain Log Server • SmartEvent ⠀ The vulnerability carries a CVSS score of 9.8. ⠀ Check Point advises installing the applicable fixes, restricting management access to trusted IP addresses, and checking for signs of exploitation. ⠀ LivePatch Take 28/29 does not fix this vulnerability.

🚨 CHECK POINT ZERO-DAY EXPLOITED IN THE WILD — CISA ADDS CVE-2026-93616 TO KEV Check Point has disclosed a critical zero-day affecting its Security Management infrastructure after identifying targeted exploitation. * CVE-2026-93616 carries a CVSS score of 9.8 * The flaw combines directory traversal and file upload weaknesses * An unauthenticated attacker who can reach the affected service can upload and execute arbitrary scripts on the Management Server * Check Point says it observed a handful of targeted attacks dating back to July 23 * Security Management Server, Multi-Domain Security Management, Log Server, Multi-Domain Log Server and SmartEvent are affected * Check Point has released emergency fixes and IOC/hunting guidance * CISA has now added the vulnerability to its Known Exploited Vulnerabilities catalog ⚠️ Analyst Note: This is particularly sensitive because the vulnerable system is the management plane responsible for security policies across Check Point environments. Organizations running affected versions should patch immediately and hunt for historical exploitation rather than treating installation of the hotfix as sufficient remediation. https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/ #CheckPoint #ZeroDay #CVE202693616 #CISA #CyberSecurity #ThreatIntel #DDW

🚨 CISA ADDS FOUR KNOWN EXPLOITED VULNERABILITIES — F5 BIG-IP APM CVE-2026-94127 LEADS CISA has updated the Known Exploited Vulnerabilities catalog (2026.09.22, 1721 entries) with four additions. The new lead for operators is F5 BIG-IP APM CVE-2026-94127, which was not previously covered on this channel. • CVE-2026-94127 — F5 BIG-IP APM heap-based buffer overflow • Actively exploited; federal BOD due date 2026-09-25 • Security reporting: unauthenticated RCE when an APM access policy and OAuth profile are on a virtual server (CVSS ~9.8) • Hotfixes available for 21.1.0 / 17.5.x / 17.1.x trains; temporary iRule mitigation until patched Also added (already covered earlier today — not rehashed as standalone posts): • CVE-2026-85102 / CVE-2026-93616 — Check Point • CVE-2026-93952 — Arista VeloCloud Orchestrator ⚠️ Analyst Note: Treat the F5 BIG-IP APM entry as urgent for environments with APM + OAuth on virtual servers. Apply F5’s temporary iRule mitigation where needed, then install the vendor hotfix. CISA alert: https://www.cisa.gov/news-events/alerts/2026/09/22/cisa-adds-four-known-exploited-vulnerabilities-catalog F5 advisory: https://my.f5.com/manage/s/article/K000162605 CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog #DDW #DarkWeb #CISA #KEV #F5 #BIGIP #ThreatIntelligence #CyberSecurity

🚨 CRITICAL — CVE-2026-93616 A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary … CVSS 9.8 🔴 No patch yet Full analysis → https://sec.kaitan.id/cves/CVE-2026-93616 #CheckPoint #CyberSecurity #InfoSec

Check Point Management zero-day CVE-2026-93616 — CVSS 9.8, actively exploited. Unauth path traversal on the Security Management web service (the box that pushes gateway policy). Targeted hits observed since Jul 23. Vendor hotfix: Sep 22.

Check Point released emergency hotfixes for CVE-2026-93616, a critical path traversal flaw in Security Management Server products being exploited in the wild, enabling unauthenticated script execution. #CheckPoint #CVE202693616 #SmartConsole https://www.hendryadrian.com/check-point-warns-of-management-server-zero-day-exploited-in-attacks/

Check Point: since Sep 12 attackers have been sending Spark firewalls a VPN certificate with subject CN=vpn. Unpatched gateways run their code (CVE-2026-85102, CVSS 9.8, fix out Sep 9). Plus a mgmt server zero-day, CVE-2026-93616, exploited since July. KEV due Sep 25. #MSP https://t.co/zIJOon4q04

米国サイバーセキュリティ・社会基盤安全保障庁(CISA)が既知の悪用された脆弱性カタログに4件の脆弱性を追加。Check Point複数製品のCVE-2026-85102+CVE-2026-93616、Arista VeloCloud OrchestratorのCVE-2026-93952、F5 BIG-IP APMのCVE-2026-94127。対処期限は3日後の9/25。 https://www.cisa.gov/news-events/alerts/2026/09/22/cisa-adds-four-known-exploited-vulnerabilities-catalog

1/5 The attack did not start at the firewall. It started at the control plane. Check Point says CVE-2026-93616 was exploited as a zero-day against Security Management servers. No authentication. CVSS 9.8. A handful of customers attacked. 🧵 https://t.co/K7h5vHf2kE

Check Point Security Management: CVE-2026-93616 is pre-auth path traversal in the management web service. Unauth attacker can run scripts from an arbitrary path and load arbitrary Java classes. CVSS 9.8. Actively exploited. Fix available today (Sep 22).

Check Point disclosed CVE-2026-93616, a path traversal zero-day in Security Management Server web services used in targeted attacks, and released fixes plus hunting guidance. #CheckPoint #ZeroDay #VPN https://www.hendryadrian.com/check-point-warns-of-management-server-zero-day-exploited-in-targeted-attacks/

sk1000171 - CVE-2026-93616: Directory Traversal and File upload allows execution of arbitrary script on the Management Server https://support.checkpoint.com/results/sk/sk1000171/ CVSS: 9.8 - Actively exploited

Attackers hit Check Point Management Servers and Spark firewalls, F5 BIG-IP APM instances: Check Point Software has released emergency fixes for a critical Check Point Management Server vulnerability (CVE-2026-93616) that has been exploited as far back… https://www.helpnetsecurity.com/2026/09/23/check-point-f5-big-ip-apm-zero-days-targeted/?utm_source=dlvr.it&utm_medium=twitter https://t.co/a1nDpoz5at

🔥 CyberForge CVE of the Day #059 🚨 CVE-2026-93616 — Check Point Security Management: pre-authentication path traversal to script execution Check Point describes attacks on 23 July. The public advisory and fixes arrived on 22 September. That gap matters for every server reachable before the patch. A Management web-service flaw lets an unauthenticated attacker upload and execute scripts. Check Point also describes arbitrary-path script execution and Java class loading. No login or click is required. CVSS v3.1: 9.8 Critical. CISA added the CVE to its Known Exploited Vulnerabilities catalogue on the day of disclosure. ⚠️ Treat this as an urgent management-server patch and a separate look back at historical exposure. 🎯 The quick hit: 🔹 Affected: Security Management and related roles, including standalone appliances that run management. 🔹 Boundary: untrusted path/file input reaches a service before login. 🔹 Result: script execution and possible Java class loading. 🔹 Evidence: vendor-observed July attacks; CISA KEV listing. 🔹 Action: restrict access, apply the correct take and investigate past exposure. 🔑 Key details: ⭐ Severity: Critical 📊 CVSS v3.1: 9.8 — Check Point CNA assessment 🧮 Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` 🧠 Weakness: CWE-22 — Path Traversal 🎯 Targets: Security Management; related management/logging roles below 🧩 Vulnerable boundary: untrusted path/file input → management web service 🌐 Attack vector: Network; exposure varies ⚙️ Attack complexity: Low 🔓 Privileges required: None 👆 User interaction: None 🔀 Scope: Unchanged in CVSS v3.1 ⚔️ Impact: arbitrary-script execution and Java class loading 💥 CVSS impact: High confidentiality, integrity and availability impact 👤 Execution context: management host; precise privileges unverified 🛡️ Fix: branch-specific hotfix; exact takes below 🔑 Additional remediation: exposure review; recovery if needed 🚨 Active exploitation: Yes — vendor-observed attacks and CISA KEV 🧪 Reproduction: no complete public PoC independently validated; no exploit run 📋 CISA KEV: Added 22 September 2026; listed due 25 September for applicable federal owners 📉 EPSS: no entry as of 23 September; not 0% 🗓️ Vendor-observed attacks: 23 July 2026 🩹 Vendor fixes: 22 September; take matrix below 📜 Vendor bulletin: sk1000171 (support access may be required) 🔬 Campaign detail: a handful of pinpointed attacks; no complete public chain No CVSS v4.0 score was found. NVD is Awaiting Analysis; its 9.8 is vendor-sourced. 🧬 What actually went wrong? A management web service should confine file operations to authorised locations. Here, that boundary can be crossed before authentication. 1️⃣ Untrusted input reaches management An attacker needs network reachability, not a password. CVSS Network does not imply universal internet exposure. 2️⃣ Path validation fails CWE-22 means a path can escape its permitted directory. The CNA connects this to file upload; the exact route, parameter and internal function were not disclosed in the reviewed public material. 3️⃣ The service executes attacker-controlled content The CNA says scripts can be uploaded and executed. Check Point adds arbitrary-path execution and Java class loading. The July attackers’ exact sequence remains undisclosed. The remedy is the vendor fix plus restricted access. No exploit payload or guessed endpoint is included. 🧭 Management function matters more than the box label. Check Point says Quantum Force and Quantum Spark *firewall-only* devices are not affected by this management CVE. A standalone firewall that also hosts management is affected, an administrator clarified. Smart-1 Cloud is already patched, per Check Point. CISA additionally lists SmartEvent, absent from the short vendor notice; include it in inventory and confirm applicability with support. The same blog covers CVE-2026-85102, a separate Gateway VPN-certificate flaw. Its Spark scope, certificate indicators and September 12 attack date do not belong here. ⚔️ The practical attack chain: This outlines capability, not a disclosed step-by-step account of the July attacks. 1️⃣ An affected management service is reachable. 2️⃣ Unauthenticated input reaches its file/path handling; exact route and parameter are unknown. 3️⃣ Path restrictions fail; the CNA describes an upload-and-execute outcome, with exact order unpublished. 4️⃣ A script executes; Check Point also describes Java class loading. 5️⃣ Investigators assess actual host access and follow-on activity. The first four points reflect vendor/CNA capability; step five is CyberForge triage. Neither policy tampering nor gateway compromise is established. 👤 Execution context — what the attacker actually gets. Code execution on Security Management is serious. Public sources do not establish the exact service user, root access or a victim’s available permissions. Assess policy revisions, administrators, secrets, logs and connected gateways according to local privileges and evidence. These are investigation areas, not reported actions by the July attackers. Use independent host, network, identity and change records to determine whether any capability was used. 📦 Affected products and versions. The CNA names Quantum Security Management. Check Point lists Security Management Server, Multi-Domain Management Server, Log Server and Multi-Domain Log Server. CISA also lists SmartEvent; confirm its applicability with support. Affected range → vendor-announced fixed take: 🔹 R82.20: R82.20 without Jumbo Hotfix → Security Hot Fix Take 1. 🔹 R82.10: Jumbo Hotfix Take 44 or lower → JHF Take 45. 🔹 R82: Jumbo Hotfix Take 126 or lower → JHF Take 127. 🔹 R81.20: Jumbo Hotfix Take 166 or lower → JHF Take 170. 🔹 R81.10 (end of support): Jumbo Hotfix Take 190 or lower → JHF Take 192, or vendor-supported upgrade. 🔹 R81 and R80.40/R80.30/R80.20/R80.10/R80 (end of support): listed as affected; obtain a supported migration or replacement route from Check Point. Version trap: the public cutoff does not establish whether intermediate R81.20 Takes 167–169 or R81.10 Take 191 are fixed. Install the named fixed take or seek vendor confirmation. R82.20 takes a Security Hot Fix. LivePatch Takes 28/29 do not fix this CVE. Verify the running take, not a downloaded package. Include virtual, standalone, logging, secondary and disaster-recovery management systems; record each role and take. 🕰️ Timeline / exploitation window. 🔴 23 July 2026: Check Point reports pinpointed attacks. This observed date is not necessarily the first or last attack. 🔎 18 September: CVE reserved; an administrative date, not an attack timestamp. 🟢 22 September: advisory, fixes, CVE publication and CISA KEV addition. 🔎 23 September: CyberForge source checks. 📅 25 September: CISA KEV due date for applicable federal owners; an urgency signal elsewhere. Hunt beyond July 23. Reconstruct past reachability and log coverage until the fix. Exposure warrants triage; it does not prove compromise. 👁️ Defender hunting guide: These are CyberForge hypotheses, not exploit signatures. Use sk1000171 for official IOCs and supported collection. 1️⃣ Reconstruct exposure and version history Record role, exact take, management IP, patch time, peers and standalone status. Join historical upstream rules, NAT, VPN, allowlists and support access around 23 July and afterward. A current rule cannot prove July reachability. Preserve event-time IP ownership and timezone. 2️⃣ Review management traffic in context Check web-service, proxy, firewall and flow logs for unfamiliar sources, unauthenticated requests and upload events. Correlate requests with later host activity. Check Point recommends restricting TCP 19009 to trusted IPs. That is an access-control action; do not assert every exploit request always used 19009 without evidence from the actual deployment or vendor article. An encrypted flow may show a connection while hiding HTTP content. 3️⃣ Inspect the management host using supported procedures Look for newly written executable content, unexpected scripts or classes, web-service-linked process starts, altered service startup settings and unexplained outbound communication. Record file hashes, owner, creation/change times, process parent and connection details where available. These are investigation pivots, not July IOCs. Preserve suspicious artefacts before removal. 4️⃣ Check management integrity and connected scope Compare policy revisions, administrators and logging destinations with independent baselines and change tickets. If compromised, assess secrets and gateways actually reachable from that instance. Cross-check against upstream firewall logs and independent backups. A suspect management/log server may be incomplete evidence about itself. 5️⃣ State the visibility limit honestly Write down search terms, time ranges, retention, logging gaps and whether sk1000171 IOCs were actually available. “No suspicious events in retained firewall flows; July application logs absent” is a meaningful bounded finding. Missing logs cannot support an unqualified “clean” verdict. 🩹 Emergency remediation order: 1️⃣ Reduce reachability and preserve evidence Limit management TCP 19009 to trusted sources as Check Point advises, and review other management paths in the local topology. Preserve external access logs, configuration, running-build details and host evidence where safe. Do not delay containment of an active incident for perfect collection. 2️⃣ Choose the exact vendor fix Match each asset’s branch, role and installed take to the matrix above and Check Point’s detailed sk1000171. Obtain the approved package from official channels. For end-of-support trains, get a supported upgrade/replacement plan; an unlisted take is not a safe assumption. 3️⃣ Install, restart as directed and verify the running take Coordinate Multi-Domain, HA, logging and standalone dependencies. Follow the vendor’s compatibility and maintenance order. No public verification command was reproduced here because the detailed support article was unavailable; use the vendor’s actual supported procedure. Check management and log functions after the change. 4️⃣ Hunt the historical window Review July-era exposure, possible attacker activity and the time through patch. Record what telemetry was present, what was checked and what remains unknown. Keep this open even after the patch ticket is closed. 5️⃣ Recover and rotate according to evidence If compromise is confirmed or host integrity cannot be bounded, involve Check Point and incident response in a supported recovery from known-good media/configuration. Rotate or revoke secrets actually exposed from a trusted system after containment; assess downstream access rather than presuming universal credential loss. 6️⃣ Validate and monitor Record a running fixed take and access restriction for every relevant member. Verify policy installation and log collection. Watch for renewed unauthorised access or reuse of exposed credentials. 🧱 Temporary exposure reduction. ✅ Limit TCP 19009 to a small set of approved administrator IPs, as Check Point recommends. ✅ Review upstream rules, VPN paths, NAT, remote-support access and any management interface with reachability to affected roles. ✅ Include standalone devices that run both gateway and management functions. ✅ Maintain trusted external logging and preserve a supported recovery path while restricting access. ✅ Use the vendor’s detailed mitigation guidance if a fix cannot be installed immediately. These controls reduce the reachable attack surface. They do not replace the hotfix or establish that a previously reachable server was never compromised. 🚑 When vulnerability management becomes incident response. Escalate for investigation when you see: 🔴 Historical access from an unauthorised source while an affected take ran. 🔴 Vendor-published IOC matches confirmed with context. 🔴 Suspicious management requests followed by unexplained scripts, classes or process activity. 🔴 Unapproved administrator or policy changes, altered logging or unusual egress. 🔴 Evidence of secrets being used from unfamiliar systems or locations. 🔴 Significant July-era exposure with insufficient records to establish integrity. Plan containment around critical management and logging dependencies. A vulnerable build alone does not prove theft, persistence, ransomware or downstream gateway compromise; a patched build alone does not clear historical activity. 📊 CISA KEV and EPSS context. Checked 23 September 2026: 🔹 CISA KEV: CVE-2026-93616 added 22 September, due 25 September for applicable owners; forensic triage Yes; ransomware use Unknown. 🔹 FIRST EPSS API: `total: 0`, with no dated score or percentile for this CVE. An absent EPSS row is missing model data, not a 0% probability. The known attacks and KEV inclusion are stronger operational signals. Follow the applicable CISA requirements if they govern your organisation. 🧾 Evidence separation. Vendor-confirmed: affected Management web service, pre-authentication path traversal, script execution/Java class loading, July 23 observed attacks, patch availability, exact named hotfixes and TCP 19009 access restriction. CNA / government records: CVSS v3.1 9.8, CWE-22 and affected branch ranges from the Check Point CNA; CISA’s known-exploited listing and its dates/triage field. NVD currently attributes its score to Check Point. CyberForge interpretation: exposure priorities, host and policy hunting, execution-context questions, recovery ordering and incident escalation. These are practical analysis, not published details of July victim systems. Not established: exact exploit endpoint, parameter, payload, full IOCs, a verified complete public PoC, runtime privilege level, persistence, data theft, full victim count or compromise of every gateway managed by a vulnerable server. No exploit was executed. The full sk1000171 support article was not independently accessible during this review. 🔥 CyberForge verdict: CVE-2026-93616 is a Critical, actively exploited route into central security management with a clear vendor patch path and a historical triage question that patching cannot settle. Prioritise any reachable affected system, including standalone management/gateway devices and secondary management roles. Use exact running takes, actual network paths and evidence from the July window to decide what happened locally. The response sequence is: 1️⃣ Restrict access and preserve useful evidence. 2️⃣ Install the branch-specific fixed take; verify the running result. 3️⃣ Hunt the period of vulnerable reachability. 4️⃣ Scope and rotate exposed secrets when indicated. 5️⃣ Recover from a trusted state if compromise is confirmed or integrity remains unbounded. 6️⃣ Monitor management activity and connected systems for follow-on abuse. The CyberForge verdict: patch the control room, then find out who could enter it before the lock was changed. 🔗 Check Point advisory and July attack statement: https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/ 🔗 Check Point fixed takes, access restriction and standalone clarification: https://community.checkpoint.com/t5/General-Topics/Action-required-Critical-Vulnerability-CVE-2026-93616-in-Check/td-p/282631 🔗 Detailed vendor guidance and IOCs (support access may be required): https://support.checkpoint.com/results/sk/sk1000171/ 🔗 CVE record: https://www.cve.org/CVERecord?id=CVE-2026-93616 🔗 NVD vulnerability record: https://nvd.nist.gov/vuln/detail/CVE-2026-93616 🔗 CISA KEV official data: https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json 🔗 FIRST EPSS query: https://api.first.org/data/v1/epss?cve=CVE-2026-93616 #CyberSecurity #CVE #CheckPoint #ManagementPlane #PathTraversal #ThreatHunting #IncidentResponse #CyberForge

🚨 Actively Exploited CVE-2026-93616 in Check Point Security Management Server Allows Unauthenticated Script Execution Critical Vulnerability Alert! Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent is affected by CVE-2026-93616. 🔍 Identify Targets via ZoomEye: Search Dork: app="Check Point" Exposure: 1.1m instances identified globally. ZoomEye Search Link: 👉 https://www.zoomeye.ai/searchResult?q=YXBwPSJDaGVjayBQb2ludCI%3D #Infosec #CyberSecurity #ZoomEye

4/5 Fixed releases include: • R82.10 Take 45 • R82 Take 127 • R81.20 Take 170 • R81.10 Take 192 • R82.20 Security Hotfix LivePatch Takes 28/29 do not address CVE-2026-93616. Older R80/R81 branches are EoS and also affected.

3/5 Do not mix the two campaigns disclosed together. CVE-2026-85102 targets VPN certificate handling on gateways. CVE-2026-93616 targets the management plane and affects Security Management, Multi-Domain Management, Log Server and SmartEvent.

استغلال نشط لثغرتين يتطلب مراجعة أمنية فورية. التحذير الأمني يشير إلى CVE-2026-85102 وثغرة Management Pre-Authentication برقم CVE-2026-93616، ما يعني أن الخطر لا يقتصر على وجود الثغرة فقط، بل يشمل محاولات استغلال فعلية. القيمة التقنية هنا هي إعطاء فرق الأمن أولوية واضحة: تحديد الأنظمة المتأثرة، مراجعة واجهات الإدارة، تطبيق التحديثات أو إجراءات التخفيف، وفحص السجلات بحثًا عن مؤشرات استغلال. الأثر العملي قد يشمل تقليل نافذة التعرض، حماية الوصول الإداري، وتسريع قرارات الاستجابة للحوادث قبل توسع نطاق الاستغلال. Active exploitation changes the priority of any vulnerability advisory. This security advisory highlights CVE-2026-85102 and CVE-2026-93616, a management pre-authentication vulnerability, which makes exposure assessment and remediation time-sensitive. For security teams, the immediate value is clear: identify affected assets, review management interfaces, apply vendor guidance, and inspect logs for signs of attempted or successful exploitation. The practical impact is faster risk reduction, stronger protection of administrative access, and better incident response readiness while exploitation is active. https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/ #CyberSecurity #CVE #VulnerabilityManagement