CVE-2026-93616
Check Point management-server traversal and upload flaw allowing unauthenticated script execution.
Check Point said a handful of customers were attacked through CVE-2026-93616 before CISA listed the management-server flaw as exploited on 22 September 2026, giving federal agencies until 25 September to fix it.
Last refreshed: 12 October 2026
Why did a Check Point gateway patch leave management servers open?
Timeline for CVE-2026-93616
Mentioned in: Two 9.8 Check Point flaws hit firewalls
Cybersecurity: Threats and DefencesBackground
CVE-2026-93616 combines directory traversal with a file upload weakness, letting an attacker with no credentials place and run scripts on a Check Point management server. Check Point's advisory sk1000171 scores it 9.8 and lists Security Management Server, Multi-Domain Security Management, Log Server and SmartEvent as affected, including R81.20 up to Jumbo Hotfix Take 166.
Check Point told customers to accept traffic on TCP port 19009 only from trusted addresses and warned that LivePatch does not close the hole. The company reported attacks on "a handful of customers", and CISA added the flaw to its exploited list on 22 September 2026. A second 9.8 flaw, hitting Spark firewalls, was listed the same day, so Check Point estates needed two separate updates.
Each Check Point management server writes the security policy for every gateway it controls, so taking one over hands an attacker the rules for the whole fleet.