Check Point warns of Management Server zero-day exploited in attacks

Check Point Software has released emergency hotfixes for a critical vulnerability in its Security Management Server. The company says the flaw is being exploited in the wild and that it is aware of a handful of customers who were attacked.

Tracked as CVE-2026-93616, the path-traversal vulnerability allows unauthenticated attackers to upload arbitrary scripts to vulnerable Check Point Management Servers and execute them in low-complexity attacks. The affected Security Management Server stores and manages security policies, processes administrator changes, and collects system logs across enterprise networks.

Check Point addressed the issue in R82.20 Security Hotfix. The company’s complete list of affected products includes Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent.

Check Point advises security teams to inspect their networks for evidence of successful exploitation using the indicators of compromise in its security advisory. Customers unable to deploy the hotfix immediately can use temporary mitigations, including placing vulnerable systems behind a firewall and limiting access to trusted IP addresses through SmartConsole.

CISA and the FBI have urged software companies to remove path-traversal weaknesses before shipping products.