Check Point has released emergency hotfixes for a critical Security Management Server vulnerability. The company says attackers have already targeted a handful of customers.
The Check Point zero-day, tracked as CVE-2026-93616, lets attackers upload and run scripts on vulnerable systems without signing in. Check Point urges administrators to apply the hotfix and investigate possible compromise.
Path Traversal Flaw Threatens Central Management Servers
CVE-2026-93616 is a path traversal flaw. Attackers can use it to place scripts on a vulnerable management server and execute them without valid credentials.
These servers play a central role in enterprise security. They store security policies, process administrator changes and collect logs from across the network. Therefore, unauthorized access could affect more than one device.
Check Point lists five affected products: Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent. Organizations should check their deployments against the company’s advisory.
Check Point Confirms Attacks and Releases a Hotfix
Check Point says attackers have exploited the vulnerability in the wild. It knows of a handful of customers who have been attacked, although it has not disclosed further details about those incidents.
The company addressed the flaw in its R82.20 Security Hotfix. It also published indicators of compromise to help security teams look for evidence of an attack.
Administrators should review those indicators even after installing the fix. A hotfix can close the vulnerability, but teams still need to investigate any activity that occurred before they applied it.
Trusted Client Rules Can Reduce Exposure
Some organizations may need time to deploy the hotfix. Meanwhile, Check Point recommends placing vulnerable systems behind a firewall and limiting management access to trusted IP addresses.
Administrators can configure Trusted Clients through the Permissions & Administrators settings in SmartConsole. These restrictions can reduce exposure while teams prepare the update.
However, access controls do not replace the hotfix. Organizations should patch affected servers, examine relevant logs and investigate any signs of unauthorized access.
0 responses to “Check Point Patches Management Server Zero-Day Exploited in Attacks”