Check Point patches actively exploited Management Server zero-day CVE-2026-93616

Check Point says attackers are exploiting a critical flaw in its Management Server products, putting organizations that use them at immediate risk until they patch. The bug, CVE-2026-93616, is an unauthenticated path traversal vulnerability that can let an attacker upload and execute arbitrary scripts on Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent; fixes are in the R82.20 Security Hotfix, with temporary mitigations and indicators of compromise also provided.

Why it matters: These systems centrally manage security policies and logs, so a compromise can give attackers a strong foothold in an organization’s defenses. Affected Check Point customers should apply the hotfix immediately, review indicators of compromise, and restrict access to trusted IPs if they cannot patch right away.

Sources

Check Point warns of hackers exploiting Security Gateway VPN RCE flaw

Bill Toulas 2026.09.23 96% relevant

This article directly updates that same underlying event by adding that CVE-2026-93616 has been exploited since July 23, is now in CISA's KEV catalog, and is being discussed alongside active exploitation of CVE-2026-85102 affecting Security Gateway VPN.

Check Point Patches Exploited Management Server Zero-Day

Ionut Arghire 2026.09.23 99% relevant

This article is a direct report on the same event, adding that CVE-2026-93616 is a directory traversal and file upload bug with a 9.8 CVSS score, affects multiple Check Point management and logging products, has hit a handful of customers, and that CISA also added Check Point VPN flaw CVE-2026-85102 to KEV after exploitation attempts against Spark customers.

Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks

info@thehackernews.com (The Hacker News) 2026.09.22 98% relevant

This article appears to cover the same underlying event: Check Point warning that a Management Server zero-day is being exploited in targeted attacks. It likely adds source reporting and attack context around the active exploitation and vendor warning tied to CVE-2026-93616.

Check Point warns of Management Server zero-day exploited in attacks

Sergiu Gatlan 2026.09.22 100% relevant

This article appears to be the first tracked item for CVE-2026-93616, covering the vendor's disclosure, active exploitation, affected products, and available fixes.