A directory traversal and file upload vulnerability

CVE-2026-93616 is a pre-authentication path traversal and arbitrary file upload vulnerability in the Check Point Management web service (TCP/19009). An unauthenticated attacker who can reach this port can combine directory traversal with file upload handling to plant a malicious script or Java class in an arbitrary path, then trigger the management service to execute it. This yields code execution on the Security Management Server (SMS), Multi-Domain Security Management Server (MDS), Log Server, Multi-Domain Log Server, or SmartEvent — any product running the management web service. Affected versions span the entire supported product line: R82.20, R82.10 through JHF Take 44, R82 through Take 126, R81.20 through Take 166, R81.10 through Take 190, and all End-of-Support R80.x and R81 releases.

The vendor's CRITICAL / 9.8 rating is accurate and if anything understates the operational blast radius. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) correctly captures the pre-auth, zero-click, low-complexity nature of the flaw. What CVSS cannot express is that the affected component is *the central nervous system of your entire Check Point deployment* — owning the SMS means silently rewriting every firewall policy, harvesting every VPN credential, and pivoting to every managed gateway. Check Point confirmed active exploitation on July 23, 2026, two months before the public advisory, and CISA added the CVE to the KEV catalog on September 22, 2026 with a 3-day remediation deadline under BOD 26-04. This is a drop-everything-and-patch situation.

1. Block TCP/19009 from all untrusted sources immediately — Create explicit firewall rules (NOT implied rules) restricting TCP/19009 access to named administrator IPs only. This is the single most effective mitigation and should be deployed within hours given active exploitation and KEV listing. Verify with netstat -tlnp | grep 19009 from the SMS and a port scan from an untrusted source. Per the noisgate mitigation SLA and the active-exploitation override: mitigate immediately, within hours.
2. Apply the vendor hotfix for your branch now — Install R82.20 Security Hotfix, R82.10 Take 45+, R82 Take 127+, R81.20 Take 170+, or R81.10 Take 192+ per SK1000171. LivePatch Take 28/29 does NOT fix this — a full JHF or Security Hotfix install is required. The CISA KEV 3-day deadline (September 25, 2026) supersedes the noisgate CRITICAL remediation SLA of 90 days. Patch immediately.
3. Hunt for indicators of compromise on every SMS/MDS — Check cpm.elg for usernames exceeding 1,000 characters. Grep for ReflectionUtils errors containing ../ traversal sequences. Look for concurrent FWM or MDS core dumps in /var/log/dump/usermode/. Review SmartConsole audit logs for unauthorized administrator creation or policy changes since July 23, 2026. Cross-reference source IPs 151.241.99.207, 151.241.99.233, 158.62.198.182, 192.142.10.99, 139.28.37.250 from the related campaign.
4. Set Trusted Clients to explicit named IPs on all management servers — Change the Trusted Clients configuration from 'Any' to explicitly listed administrator IPs or ranges. The 'Any' setting is the primary reason management ports become internet-exposed or broadly reachable. This should be a permanent hardening measure, not just a temporary mitigation. Apply within hours alongside the port-blocking control.
5. Upgrade all End-of-Support branches immediately — R80.x and R81 (non-point-release) have no fix available. These must be upgraded to a supported branch (R81.20+ or R82+) and then patched. There is no workaround for EOS versions beyond strict network isolation of TCP/19009. Begin the upgrade project immediately with a target completion within the noisgate CRITICAL remediation SLA of 90 days.
6. Validate gateway policy integrity if any IoCs are found — If compromise indicators are detected, assume all managed gateways are affected. Compare running gateway policies against offline backups from before July 23, 2026. Rotate all SIC certificates, administrator credentials, and VPN pre-shared keys. Check for unauthorized administrator accounts, backdoor firewall rules, and unexpected policy installations.

Run this script directly on each Check Point Management Server (SMS or MDS) in Expert mode as root. SSH to the appliance, enter expert mode, then execute: bash check_cve_2026_93616.sh. No arguments required. The script checks the installed Gaia version and JHF take level against the fixed versions and outputs PATCHED, VULNERABLE, or UNKNOWN with appropriate exit codes.

#!/bin/bash
# CVE-2026-93616 - Check Point Management Server Path Traversal
# Run on the SMS/MDS appliance in Expert mode as root.
# Exits: 0=PATCHED  1=VULNERABLE  2=UNKNOWN

echo "=== CVE-2026-93616 Vulnerability Check ==="
echo "Check Point Management Server Pre-Auth Path Traversal"
echo ""

[ ! -f /etc/cp-release ] && echo "UNKNOWN - not a Check Point appliance" && exit 2
REL=$(cat /etc/cp-release)
echo "Release: $REL"

cpprod_util FwIsFirewallMgmt 2>/dev/null | grep -q 1 || { echo "UNKNOWN - not a management server"; exit 2; }
echo "Role: Management Server confirmed"

TAKE=0
for f in /opt/CPsuite-*/fw1/conf/jumbo_hf_installed_take.conf; do
  [ -f "$f" ] && TAKE=$(tr -dc '0-9' < "$f") && break
done
echo "Jumbo Hotfix Take: $TAKE"
echo ""

check() {
  if [ "$TAKE" -ge "$1" ] 2>/dev/null; then
    echo "PATCHED - Take $TAKE (fixed in Take $1+)"
    exit 0
  else
    echo "VULNERABLE - Take $TAKE (needs Take $1 or later)"
    exit 1
  fi
}

case "$REL" in
  *R82.20*)
    cpinfo -y all 2>/dev/null | grep -qi "Security Hotfix" && echo "PATCHED - R82.20 Security Hotfix applied" && exit 0
    echo "VULNERABLE - R82.20 missing Security Hotfix"
    exit 1;;
  *R82.10*) check 45;;
  *R82*)    check 127;;
  *R81.20*) check 170;;
  *R81.10*) check 192;;
  *R80*|*R81*)
    echo "VULNERABLE - $REL is End of Support with no fix. Upgrade required."
    exit 1;;
  *)
    echo "UNKNOWN - unrecognized version"
    exit 2;;
esac

1. Check Point Security Advisory (Blog)
2. CISA KEV Alert - September 22, 2026
3. Check Point Support SK1000171
4. Pre-Auth Path Traversal Analysis (Dev.to)
5. CyberSecurity News - Check Point 0-Day
6. TheHackerWire CVE Detail
7. OffSeq Threat Radar
8. SmartTech247 Threat Intel Report