Check Point Management Server Unauthenticated Remote Code Execution (RCE) Vulnerability (CVE-2026-93616)

Affected Vendors

Check Point

Affected Components

Management Server

Published Date

2026-09-22

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Check Point Management Server (R80.x, R81.x series)

Impact

Unauthenticated attackers can upload and execute arbitrary scripts via directory traversal, leading to full system compromise.

Mitigation

Apply the vendor-provided emergency hotfix and restrict management interface access from the public internet.

Affected Products & Version Scope

All supported versions of Check Point Management Server, including R80.x and R81.x releases, are affected. Detailed build information is available in vendor advisory sk1000171.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Patching: Immediately install the latest Jumbo Hotfix Accumulator from the Check Point Support Center.
Network Segmentation: Ensure that management interfaces (Gaia Portal, SmartConsole) are not reachable from the public internet and are placed behind a VPN or Jump Host.
Implement ACLs: Use the Gaia Clish to restrict management access to trusted IP ranges only.

bash

# Example: Restricting management access via Gaia Clish
set management-access-control-list ipv4-address <TRUSTED_ADMIN_IP> mask <NETMASK>
save config

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Prioritize the installation of official hotfixes and verify that no unauthorized files or suspicious cron jobs have been created in the system directories.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

This vulnerability arises from insufficient input validation during file upload operations in the Check Point Management Server. By exploiting a directory traversal (CWE-22) flaw, an unauthenticated attacker can bypass security controls to write malicious files into sensitive system directories. Given its pre-authentication nature and inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, this flaw represents a critical risk for organizations with internet-facing management consoles.

Official Vendor Advisories & References

NVD Original English Description

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

https://support.checkpoint.com/results/sk/sk1000171

Source: cve@checkpoint.com · Mitigation, Patch, Vendor Advisory

https://blog.checkpoint.com/security/security-advisory-action-required-active-exploitation-of-cve-2026-85102-and-a-management-pre-authentication-vulnerability-cve-2026-93616/

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93616

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: