Zero-day in Check Point management servers exploited in targeted attacks

Check Point has released urgent hotfixes for CVE-2026-93616, a critical path traversal vulnerability in its Security Management Servers that has already been exploited in real-world attacks. An attacker able to reach the web service can upload and execute scripts without authentication, potentially gaining control of the server. The flaw also affects Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. The risk is particularly high because these systems manage firewall policies, operator activities, and security logs for the entire infrastructure. Check Point linked the exploitation to a limited number of targeted attacks observed since July 23, but it is possible that other compromises have gone undetected. Organizations must install the Security Hotfix for R82.20, restrict access to management interfaces, and check for unauthorized scripts, accounts, or changes.

Source: Security Affairs