Check Point administrators can now close a critical management server path traversal flaw that attackers exploited in a handful of targeted attacks on July 23. The company released a fix on September 22 for CVE-2026-93616, a zero-day vulnerability in the Security Management Server that carries a 9.8 CVSS score. A second alert covers active attempts, beginning September 12, to exploit a VPN certificate flaw that Check Point fixed on September 9.<\/p>\n
CVE-2026-93616 is a path traversal bug in the management server’s web service. The service does not properly limit which files and folders a request can reach. An attacker who can access the web service can exploit the flaw to upload scripts to the server and then run them, without logging in. Check Point rated the vulnerability 9.8 out of 10 on the CVSS scale in the CVE record.<\/p>\n
The management server controls firewall policies for the Check Point gateways it manages. Check Point’s advisory does not name the targets of the July attacks or the attackers, nor does it say what the attackers did after exploiting the flaw. It also does not state what network access an attacker needs.<\/p>\n
Check Point numbers the Jumbo Hotfix updates for each release by Take. The CVE record lists these versions as affected:<\/p>\n
Check Point’s advisory lists R82.20 as affected without the no Jumbo Hotfix condition. Administrators should note that the LivePatch fix for a separate management server flaw, CVE-2026-91843, released on September 16 as LivePatch Take 28 or Take 29 on R82.20, does not fix CVE-2026-93616.<\/p>\n
One take number matters for anyone who patched the earlier VPN certificate flaw CVE-2026-85103. On R82.10, R82, and R81.20, the new flaw’s affected list goes one take higher than that flaw’s. A server updated only enough to be outside the September flaw’s range is still affected by CVE-2026-93616.<\/p>\n
Fixed builds, mitigation guidance, hunting steps, and indicators of compromise are in Check Point support article sk1000171. Administrators should follow three steps:<\/p>\n
Installing the fix does not show whether the server was attacked before. Running the hunting checks is the only way to establish that.<\/p>\n
CVE-2026-85102 sits in the way Check Point gateways check certificates while a VPN connection is being set up. It may let an attacker who has not logged in run code on the gateway. Fixes have been available since September 9 and are documented in support article sk1000117.<\/p>\n
The affected products are Security Gateway and Spark firewalls, whether centrally or locally managed, on R81 and R81.10 (both end of support), R81.10.x, R81.20, R82, R82.00.x and R82.10. The Netherlands’ National Cyber Security Centre states the flaw applies when these products use Site-to-Site VPN or Remote Access VPN.<\/p>\n
Check Point says attackers have been attempting exploitation since September 12, targeting customers of Spark, the company’s firewall line for small businesses. When the fix came out, Check Point had no evidence the flaw was being exploited. The attempts came from anonymizing infrastructure, including VPN services and proxies, and used certificates with these subjects:<\/p>\n
The list is not complete, and other subjects may be in use. Administrators should check logs for any unusual certificate-based Mobile Access login, not only those with these subjects. They should also check what suspicious Mobile Access users do after logging in, which often includes scanning internal ports and services.<\/p>\n
Check Point says customers who installed the September 9 fix are protected, but the advisory does not say whether any attempt succeeded. For gateways that cannot be patched yet, the NCSC lists a Check Point workaround for Site-to-Site VPN: turn off the implied VPN rules and allow UDP ports 500 and 4500 only from specific peer IP addresses. The workaround does not apply to locally managed Spark firewalls.<\/p>\n
CVE-2026-93616 is a path traversal vulnerability in the Security Management Server’s web service, rated 9.8 on the CVSS scale. It allows an attacker with access to the web service to upload and run scripts without logging in. Attackers exploited it in targeted attacks on July 23, 2026.<\/p>\n
Affected versions include R82.20 with no Jumbo Hotfix, R82.10 with Jumbo Hotfix Take 44 or below, R82 with Take 126 or below, R81.20 with Take 166 or below, and R81.10 with Take 190 or below, plus older end-of-support releases R81 through R80.<\/p>\n
Install the fix from Check Point support article sk1000117, released September 9. Customers who installed that fix are protected. For gateways that cannot be patched yet, a workaround for Site-to-Site VPN involves turning off implied VPN rules and allowing UDP ports 500 and 4500 only from specific peer IP addresses.<\/p>\n