CVE-2026-93616: critical Check Point vulnerability actively exploited

CVE-2026-93616: critical Check Point vulnerability actively exploited

In short

CVE-2026-93616 is a critical vulnerability (CVSS 9.8) affecting Check Point management servers that allows an attacker, without needing to authenticate, to upload and execute arbitrary files on the system [1]. It is confirmed to be actively exploited and is listed in CISA's Known Exploited Vulnerabilities catalog (KEV) [2]. If your organization uses Check Point to manage perimeter security, acting today is a priority: the first step is identifying which Check Point management servers you have exposed and applying the corresponding vendor update without delay.

What it is and why it matters

The vulnerability is a path traversal type combined with file upload. In simple terms: an external attacker can trick the server into accepting and executing a script in a location where it shouldn't have permission, without needing valid credentials. The affected vendor is Check Point and the flaw is concentrated in its management server (Security Management Server) and the log server (Log Server) [1].

The assigned CVSS is 9.8 out of 10, rated as critical, and the vulnerability was published on September 22, 2026 [1]. What particularly raises the urgency level is that this is not a theoretical risk: it is included in the KEV catalog of the US agency CISA, which only adds vulnerabilities with evidence of active exploitation in the real world [2]. From OCIRIA's intelligence radar, we assess this type of flaw as especially sensitive because the management server is not just another asset: it is the point from which firewall rules and the security of the entire perimeter network are administered, so its compromise can give an attacker a far greater level of control than that of an individual server [3].

Who is affected

It affects organizations that use Check Point products in their security management infrastructure [1]. If your company works with Check Point to administer firewalls, gateways, or network security policies, this advisory concerns you directly. The actual level of exposure depends on whether the management server or the Log Server are accessible from outside the corporate network, something that should be verified as soon as possible.

How to know if you are vulnerable

The first step is a quick inventory: what Check Point products does your organization have deployed, and in what version? The vulnerability affects Check Point in general according to the official data available [1], so, when in doubt, the prudent approach is to treat any Check Point management server as potentially affected until confirmed otherwise with the vendor.

Second, review the exposed surface: check whether the admin panel, the management server, or the logging service are reachable from the internet or from poorly controlled network segments. A management asset that shouldn't be exposed and is significantly increases the real risk, even before confirming the exact software version.

Finally, review recent logs and files for unusual file uploads or unrecognized scripts in management system paths, especially in the weeks since the vulnerability was published [1].

How to protect yourself

1. Update immediately. Apply the patch or fixed version released by Check Point for the Security Management Server and the Log Server, following the vendor's official procedure.

2. Restrict management access. If the management server is accessible from untrusted networks or the internet, limit access to known administration IP addresses only, using access control lists or a VPN.

3. Review recent files and access. Look for scripts or files uploaded without justification in the management server paths, and keep the logs for further analysis if you detect anything anomalous.

4. Verify your real exposure. Since this vulnerability is exploited without authentication, checking which management services are actually visible from outside is a step no organization using Check Point should skip.

5. Prioritize over other patching tasks. Being in the KEV catalog, this vulnerability should be treated with greater urgency than routine patching [2].

Frequently asked questions

Do I need to be authenticated to be affected? No. The official description indicates that an unauthenticated attacker can exploit the vulnerability [1].

Is it actually being exploited or is it a potential risk? There is evidence of active exploitation, which is why it was included in CISA's KEV catalog [2].

Does it only affect a specific version of Check Point? The official data available identifies Check Point as the affected vendor without further specific version details in this entry; we recommend confirming directly with the vendor which exact versions require an update.

What should I do if I don't know whether my infrastructure is exposed? Checking the exposed surface of your management systems is the fastest step to resolve the uncertainty before deciding on next actions.

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-93616
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json