cyfenced.com →

[ CVE-2026-93616 · Published 22 Sep 2026 ]

Unauthenticated script upload in Check Point Management Server

Exploited · CISA KEV CVSS 9.8 EPSS 76%2 agency advisoriesFix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2026-09-22
  • EPSS: 76% chance of exploitation in the next 30 days (higher than 100% of CVEs)
  • Critical severity: CVSS 9.8

[ Analyst view ]Is this a red alert for you?

Red alert

CISA lists it as exploited, and it lets an attacker run code without credentials.

Red alert if
You run Check Point Security Management or Log Server on an affected version, especially if its interface is reachable from the internet.
Can wait if
You use Check Point's cloud-managed service, or the hotfix is already installed.
What it is
A directory traversal and file upload flaw lets an attacker upload and run scripts on Check Point Quantum Security Management Server without logging in. R82.20 without a Jumbo Hotfix and older R82, R81.20 and R81.10 Jumbo Hotfix takes are affected.
Impact
An attacker without credentials can run code on the server that manages your Check Point firewalls. That gives them the power to change and push firewall policy, read logs and use the server as a stepping stone into the network.

How an attack would work MITRE ATT&CK

  1. T1190 Exploit Public-Facing ApplicationThe attacker uploads a crafted file to the management server's web interface.
  2. T1059 Command and Scripting InterpreterThe uploaded script runs on the management server.
  3. T1562 Impair DefensesFirewall policy can be changed to let traffic through.
  4. T1070 Indicator RemovalLogs kept on the management server can be removed to hide activity.

What to do

  1. Install the Jumbo Hotfix listed in Check Point sk1000171 for your version.
  2. Make sure the management server is not reachable from the internet and allow only administrator workstations.
  3. Review recent policy installations, administrator accounts and files on the server for anything you did not do.
  4. If you find signs of compromise, follow Check Point's guidance and rotate administrator credentials and certificates.
Written with AI from the sources on this page on 23 Oct 2026. Check the vendor's advisory before you act.

[ Description ]Official description

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

CISA: Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 25 Sep 2026): Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

[ Advisories ]Government CERT advisories

[ References ]References