CVE-2026-93616: unauthenticated path traversal in Check Point management servers under active exploitation

What happened

A path traversal vulnerability tracked as CVE-2026-93616 affects a range of Check Point management and logging products, and it is being exploited in the wild. According to a dev.to analysis of the flaw, it carries a Critical rating of 9.8 under CVSS v3 and is classified as CWE-22. CISA added the bug to its Known Exploited Vulnerabilities catalog on September 22, 2026, citing evidence of active attacks, and Check Point has acknowledged that a small number of its customers were hit.

How the attack works

CISA, as quoted in the dev.to write-up, describes the flaw as one that lets an unauthenticated attacker upload and execute arbitrary scripts. The traversal weakness allows an uploaded file to escape the directory where it is supposed to land, after which the server runs it.

Exploitation hinges on one condition: the vulnerable service must be reachable on TCP port 19009 on an affected build. No credentials are needed. The dev.to article reports that the observed attack sequence is a direct connection to that port followed by a crafted upload that escapes its intended location. A public proof-of-concept has not been confirmed, but exploitation in the wild is attested by both the vendor and CISA, which the author argues should drive prioritization regardless.

Which products and builds are affected

The affected set, per the dev.to analysis, covers Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent.

Reported vulnerable releases include R82.20 without a Jumbo Hotfix, R82.10 with Jumbo Hotfix Take 44 or below, R82 with Jumbo Hotfix Take 126 or below, R81.20 with Jumbo Hotfix Take 166 or below, and R81.10, now end of support, with Jumbo Hotfix Take 190 or below. R81 and older end-of-support releases from R80 onward are also reported as vulnerable. Smart-1 Cloud and Check Point Firewall Appliances are reported as unaffected.

Because exposure is defined by hotfix take level as well as release family, the analysis stresses that build-level verification is required rather than a simple version check.

Reading the internet-wide numbers

ZoomEye, as cited in the analysis, shows 1,068,268 internet-facing instances matching a Check Point fingerprint, and zero matching the CVE-2026-93616 identifier. The dev.to article argues these figures are easy to misread. The large count says nothing about which builds those systems run or whether their management interfaces are reachable; the zero reflects a gap in indexing coverage for the new CVE identifier, not an absence of vulnerable systems. The population that actually matters is the subset with management interfaces answering on TCP 19009, and that can only be established by direct testing rather than inferred from aggregate scan counts.

What admins should do now

At the time the article was written, no final patch covering all affected releases was available, and LivePatch Take 28 and Take 29 do not resolve the flaw.

The recommended mitigations are to place the management interface behind a security gateway, restrict TCP port 19009 to trusted IP addresses, and follow Check Point's official advisory, SK1000171, for release-specific fix status, applying vendor updates as they ship.

Validation matters as much as patching. Confirm from an external vantage point that no management or log server interface answers on port 19009, and review management server logs for unexpected upload or script execution activity. Because exploitation requires no authentication, authentication auditing alone is unlikely to surface an attempt.

Why it matters

This is not an edge-service bug. Successful script execution on a management server puts an attacker inside the firewall control plane, where security policy can be rewritten, configuration data read, and the trusted management channel used to reach managed devices. A compromise of the logging and SmartEvent components hands over the records organizations rely on for detection and investigation, damaging both the defensive posture and the ability to reconstruct an incident. With active exploitation confirmed, a place on CISA's catalog, no complete patch yet, and no authentication required, the practical response is immediate: verify exact builds, close port 19009 to untrusted networks, and hunt management logs for signs of upload activity.