Check Point Warns Attackers Are Exploiting Critical Management Flaw

Check Point has warned that attackers are actively exploiting CVE-2026-93616, a critical vulnerability affecting Check Point Quantum Security Management products. The flaw has a CVSSv3 score of 9.8 and combines directory traversal with unrestricted file uploads, allowing an unauthenticated attacker to upload a malicious payload and execute arbitrary scripts on a Management Server. The attack can be launched against an exposed server through TCP port 19009.

Check Point said it is aware of “a handful of customers who have been attacked”; the article says vulnerability details are public, but no public proof-of-concept has been confirmed.

Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent. Listed affected releases include R82.20 without a Jumbo Hotfix; R82.10 with Jumbo Hotfix Take 44 or earlier; R82 with Take 126 or earlier; R81.20 with Take 166 or earlier; and end-of-support R81.10 with Take 190 or earlier. Older end-of-support versions from R80 through R81 are also described as vulnerable. Smart-1 Cloud and Check Point Firewall Appliances are unaffected.

The article says Check Point has not yet released a final fix for every affected version, and that LivePatch Takes 28 and 29 do not address the vulnerability. Until remediation is available, administrators should place management servers behind a security gateway and restrict TCP port 19009 to trusted IP addresses. Check Point’s advisory contains the detailed configuration guidance.