CVE-2026-93616 · Check Point Security Management Pre-Authentication Path Traversal to…

01 · The Real Story

Like leaving the master key cabinet unlocked in the lobby while every door in the building still trusts it

CVE-2026-93616 is a pre-authentication path traversal and arbitrary file upload vulnerability in Check Point's Management web service (CPM, TCP 19009). The FileSvcRemote.uploadFileToServerFileSystem SOAP endpoint concatenates an attacker-supplied filename from a SOAP header onto a temp directory without canonicalization, so a filename containing ../ escapes the intended directory and writes attacker-controlled content anywhere the Java process (running as root) can write. Combined with a forged session via LoginSvcRemote.loginNew — which accepts identity as a plain string and never verifies TLS client certificates — an unauthenticated attacker chains: forged session → path-traversal file write → cron overwrite → root-level code execution. Affected products include Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent across versions R80 through R82.20 (prior to their respective hotfixes). Check Point released fixes on September 9, 2026, but exploitation was observed as early as July 23, 2026 — a full 48 days of zero-day exposure.

Check Point's vendor severity of CVSS 9.8 CRITICAL is accurate and, if anything, undersells the blast radius. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H correctly captures the unauthenticated, low-complexity, no-interaction nature of the attack, but the Scope metric is Unchanged — it doesn't model the fact that compromising a Management Server gives the attacker policy-push authority over every managed gateway. In practice, this is a fleet-scale security-infrastructure compromise, not a single-host event. The vendor score is the floor, not the ceiling.

"Unauthenticated root RCE on Check Point management plane — actively exploited zero-day since July 2026"

02 · The Attack Path

5 steps from start to impact.

STEP 01

Network access to CPM web service

The attacker reaches TCP port 19009 on a Check Point Management Server. This port hosts the CPM SOAP web service (/cpmws/) via Apache CXF. The service is exposed by default on all management interfaces. Censys observed approximately 3,836 hosts globally with this role visible on the internet, but the far larger attack surface is internal networks where management servers are routinely reachable from adjacent VLANs.

Conditions required:

TCP 19009 reachable from attacker position (internet or internal network)

Where this breaks in practice:

Best practice restricts 19009 to a dedicated management VLAN — but many enterprises allow broad internal access
~3,836 instances confirmed internet-exposed per Censys, a non-trivial population for targeted attacks

Detection/coverage: Censys/Shodan fingerprinting of SIC identity on 19009. GreyNoise tags for CPM probing. Firewall logs showing inbound 19009 from unexpected sources.

STEP 02

Forged management session via loginNew

The attacker reads the server's own SIC (Secure Internal Communication) name from its TLS certificate — it's in the CN field, publicly visible in the handshake. They call LoginSvcRemote.loginNew impersonating the server itself and request a READ_WRITE session. The endpoint accepts identity as a plain string with no client-certificate verification, granting a fully privileged session token. No credentials are required.

Conditions required:

Step 1 complete
Ability to send SOAP requests to /cpmws/

Where this breaks in practice:

None — the SIC name is in the server's own certificate, readable by any connecting client

Detection/coverage: CPM audit logs showing loginNew calls from non-management IP addresses. IDS signatures matching the SOAP login envelope structure.

STEP 03

Arbitrary file write via path traversal

Using the forged session, the attacker calls FileSvcRemote.uploadFileToServerFileSystem with a targetVersion SOAP header containing ../ sequences. The server concatenates this value onto a temp directory path without canonicalization or character validation, allowing the attacker to write arbitrary content to any root-writable path. Bishop Fox confirmed writing to /etc/cron.d/raid-check, overwriting a default cron job.

Conditions required:

Valid forged session from Step 2
Knowledge of target filesystem layout (standard Gaia OS paths are documented)

Where this breaks in practice:

None — the traversal is trivial and the target paths are well-known on Gaia OS

Detection/coverage: File integrity monitoring (FIM) on /etc/cron.d/, /opt/CPupgrade-tools-*/, and $FWDIR/conf/SMC_Files/. Bishop Fox's safe detection probe: send ! in targetVersion — patched systems reject with 'illegal characters'; vulnerable systems accept.

STEP 04

Root code execution via cron

The uploaded cron entry executes on the next minute boundary. The attacker's payload runs as uid=0(root) because the overwritten cron file (/etc/cron.d/raid-check) is root-owned and cron preserves the ownership model. Bishop Fox confirmed uid=0(admin) gid=0(root) on both R81.10 and R82.10 lab instances.

Conditions required:

Successful file write from Step 3
~60-second wait for cron execution

Where this breaks in practice:

None — cron runs by default on every Gaia installation

Detection/coverage: Process monitoring for unexpected child processes of crond. Auditd/syslog entries for cron job execution from modified files.

STEP 05

Output retrieval and persistence

The attacker retrieves command output using FileSvcRemote.downloadRawFile via MTOM (SOAP binary attachment) with the forged session. For persistence, attackers deploy SSH authorized_keys, reverse shells, or load malicious Java classes into the CPM classpath. From the Management Server, the attacker can push policy changes to all managed gateways, exfiltrate VPN credentials, or pivot into the internal network via SIC trust relationships.

Conditions required:

Root shell from Step 4

Where this breaks in practice:

None once root is achieved

Detection/coverage: Network monitoring for unexpected outbound connections from management servers. SIC certificate audits. Policy revision diffs in SmartConsole.

03 · Compensating Control

CRITICAL 9.8→HIGH 7.5

SEVERITY REDUCED

Block TCP 19009 from all untrusted networks immediately — Restrict inbound access to port 19009 (CPM web service) to only known SmartConsole workstations and authorized management hosts using firewall rules or the Check Point 'Trusted Clients' list under Manage & Settings. This breaks Step 1 of the attack chain for internet-sourced attacks. Deploy within the noisgate mitigation SLA of ≤3 days (CRITICAL). Given KEV listing and active exploitation, implement within hours.

CRITICAL 9.8→IGNORE 0.0

SEVERITY REDUCED

Apply vendor hotfix (sk1000171) — Install the appropriate Jumbo Hotfix: R82.20 Security Hotfix Take 1, R82.10 Take 45, R82 Take 127, R81.20 Take 170, or R81.10 Take 192. LivePatch does NOT fix this vulnerability. This is the definitive fix — deploy within the noisgate remediation SLA of ≤90 days (CRITICAL), but given active zero-day exploitation, treat as emergency and deploy within days, not weeks. For EOS versions (R80.x, R81), upgrade to a supported release.

CRITICAL 9.8→HIGH 7.0

SEVERITY REDUCED

Assume compromise on unpatched servers and initiate forensic triage — Per CISA BOD 26-04, any Management Server that was unpatched during the exposure window (July 23 – patch date) must be treated as potentially compromised. Check FIM alerts on /etc/cron.d/, SSH authorized_keys, /opt/CPupgrade-tools-*/jars/, and $FWDIR/conf/SMC_Files/. Rotate all SIC certificates, VPN credentials, and admin passwords. Review SmartConsole policy revision history for unauthorized changes. Deploy within 3 days.

CRITICAL 9.8→CRITICAL 9.0

Enable file integrity monitoring on management servers — Deploy FIM coverage on Gaia OS critical paths: /etc/cron.d/, /etc/crontab, /root/.ssh/authorized_keys, /opt/CPupgrade-tools-*/, and CPM classpath directories. This does not prevent exploitation but enables detection of Step 3 (arbitrary file write) in near-real-time. Deploy alongside network controls.

What doesn't work

LivePatch (Takes 28/29): Check Point explicitly states LivePatch does not address CVE-2026-93616. Do not rely on LivePatch for this vulnerability — a full Jumbo Hotfix installation is required.
IPS/IDS signatures alone: The SOAP traffic to 19009 uses legitimate-looking management protocol structures. While IDS can flag anomalous source IPs, the payload itself blends with normal CPM traffic. Signature-based detection has high false-negative risk without the Bishop Fox detection probe.
WAF in front of management: CPM uses SOAP over HTTPS on a non-standard port with mutual TLS expectations. Placing a WAF in front of 19009 is not a standard or supported deployment and would break legitimate SmartConsole connectivity.
Network segmentation alone (without patching): Restricting 19009 reduces the attack surface but does not eliminate it — any compromised host in the management VLAN becomes a pivot point. Segmentation buys time; it is not a fix.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	Confirmed active. Check Point observed targeted zero-day exploitation beginning July 23, 2026 — 48 days before public disclosure on September 9. CISA added to KEV on September 22, 2026 with a remediation deadline of September 25, 2026 under BOD 26-04.
Proof-of-Concept Availability	Public and weaponized. Bishop Fox (Jon Williams, Threat Enablement & Analysis Team) published a full four-step weaponized writeup at bishopfox.com. Detection tool at github.com/BishopFox/CVE-2026-93616-check. PoC Nuclei template at github.com/nebula031/CVE-2026-93616-PoC. Aggregated in SecureWithUmer/CVE-2026-PoCs.
EPSS Score	0.19654 (19.7%) — extremely high, placing this in the top tier of exploitability predictions. Consistent with confirmed in-the-wild exploitation.
KEV Status	Listed. Added September 22, 2026. Remediation due date: September 25, 2026. Forensic triage required per BOD 26-04.
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` — 9.8 CRITICAL. Network-accessible, low complexity, no privileges, no interaction. Every impact metric maxed. Scope:Unchanged undersells the cross-gateway blast radius.
Affected Versions	R82.20 (pre-Hotfix Take 1), R82.10 (Jumbo ≤Take 44), R82 (Jumbo ≤Take 126), R81.20 (Jumbo ≤Take 166), R81.10 (Jumbo ≤Take 190), R81/R80.40/R80.30/R80.20/R80.10/R80 (all end-of-support, no fix available).
Fixed Versions	R82.20 Security Hotfix Take 1, R82.10 Jumbo Take 45, R82 Jumbo Take 127, R81.20 Jumbo Take 170, R81.10 Jumbo Take 192. LivePatch Takes 28/29 do NOT fix this CVE. No LivePatch available.
Scanning / Exposure	Censys identifies ~3,836 hosts globally with the Security Management/Log Server SIC role exposed to the internet on TCP 19009. Actual internal-network exposure is orders of magnitude larger. Check Point's installed base includes tens of thousands of managed deployments.
Disclosure Timeline	Zero-day exploitation: July 23, 2026. Vendor patch release: September 9, 2026. Public advisory + NVD publish: September 22, 2026. KEV listing: September 22, 2026. Bishop Fox weaponized writeup: September 2026.
Reporting Researcher	Initial discovery undisclosed (possibly Check Point internal or incident response). Weaponized analysis by Jon Williams (Staff Security Engineer) and the Threat Enablement & Analysis Team at Bishop Fox.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to CRITICAL (9.8/10)

Why this verdict

Unauthenticated pre-auth RCE as root: The entire chain — session forgery, path traversal, file write, code execution — requires zero credentials, zero user interaction, and low complexity. The CVSS 9.8 vector is technically accurate.
Active zero-day exploitation confirmed: Check Point documented targeted attacks beginning July 23, 2026, 48 days before public disclosure. This is not theoretical — adversaries have already weaponized and deployed this in the wild against real customers.
Public weaponized PoC: Bishop Fox published a complete four-step attack chain with validated root execution on R81.10 and R82.10. Multiple GitHub repos carry Nuclei templates and detection scripts. The barrier to exploitation is essentially zero for any attacker who can reach TCP 19009.
Role multiplier: Check Point Security Management Server is the canonical high-value-role component — 100% of installs occupy the high-value role by definition. It is the centralized policy authority for every managed gateway. Compromising one Management Server gives the attacker: (a) root shell on the management host, (b) SIC trust to push arbitrary policy to all managed gateways, (c) access to stored VPN credentials and certificates, (d) ability to disable or modify security rules across the entire firewall fleet. The blast radius is fleet-scale — a single Management Server compromise is functionally equivalent to owning the entire network perimeter. This sets a CRITICAL floor that no friction analysis can breach.
Limited friction on management port exposure: While TCP 19009 should be restricted to management VLANs, Censys confirms ~3,836 internet-exposed instances. Internally, management servers are routinely reachable from broad network segments. The 'requires network access to management port' friction does not meaningfully reduce severity — it is expected access for any attacker with internal positioning, and internet exposure exists at non-trivial scale.
KEV-listed with 3-day remediation deadline: CISA imposed a September 25 deadline under BOD 26-04 with mandatory forensic triage, signaling the highest urgency tier.

Why not higher?

A CVSS score of 9.8 is already near the theoretical maximum of 10.0. The only metric preventing 10.0 is Scope:Unchanged, and while the real-world blast radius clearly crosses security boundaries (management → gateways), the direct technical impact of the vulnerability itself is confined to the management host. A 10.0 would require the vulnerability to automatically propagate without additional attacker action, which is not the case here.

Why not lower?

Every downgrade consideration fails. The only friction point — network access to TCP 19009 — is satisfied by ~3,836 internet-exposed instances and by any attacker with internal network positioning (post-phish, VPN compromise, adjacent host). The target component is a canonical high-value asset where 100% of installs are by definition critical infrastructure. Active zero-day exploitation and public weaponized PoCs eliminate any theoretical-only discount. The KEV listing with a 3-day remediation window from CISA independently confirms the CRITICAL assessment.

06 · Verification

Crowdsourced verification payload.

Run this from an auditor workstation (not the target) that has network access to the Check Point Management Server on TCP 19009. Invoke as: bash check_cve_2026_93616.sh <target_ip_or_hostname>. No special privileges required — it sends a single HTTPS probe. Requires curl and openssl.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# check_cve_2026_93616.sh — Detect CVE-2026-93616 (Check Point Management Path Traversal)
# Based on Bishop Fox safe detection methodology
# Usage: bash check_cve_2026_93616.sh <target_host> [port]
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

TARGET="${1:?Usage: $0 <target_host> [port]}"
PORT="${2:-19009}"
TIMEOUT=10
URL="https://${TARGET}:${PORT}/cpmws/LoginSvcRemote"

# SOAP envelope with illegal character '!' in targetVersion
# Patched servers reject with 'illegal characters'; vulnerable servers accept
SOAP_BODY='<?xml version="1.0" encoding="UTF-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"
               xmlns:ns="http://cpm.checkpoint.com/">
  <soap:Header>
    <targetVersion>!</targetVersion>
  </soap:Header>
  <soap:Body>
    <ns:loginAsApplicationReadOnlyPublicSession/>
  </soap:Body>
</soap:Envelope>'

echo "[*] Probing ${TARGET}:${PORT} for CVE-2026-93616..."
echo "[*] Method: Bishop Fox safe detection (illegal character in targetVersion)"

RESPONSE=$(curl -sk --max-time "${TIMEOUT}" \
  -X POST \
  -H "Content-Type: text/xml; charset=utf-8" \
  -H "SOAPAction: \"\"" \
  -d "${SOAP_BODY}" \
  "${URL}" 2>&1) || {
    echo "[!] Connection failed — host unreachable or port closed"
    echo "UNKNOWN"
    exit 2
}

if echo "${RESPONSE}" | grep -qi "illegal characters"; then
    echo "[+] Server rejected illegal character in targetVersion"
    echo "PATCHED"
    exit 1
elif echo "${RESPONSE}" | grep -qi "fault\|exception\|error"; then
    # Server processed the request but hit an error — traversal logic was reached
    echo "[-] Server processed the illegal targetVersion without rejection"
    echo "VULNERABLE"
    exit 0
elif echo "${RESPONSE}" | grep -qi "loginAsApplication\|session"; then
    echo "[-] Server accepted the request — traversal validation absent"
    echo "VULNERABLE"
    exit 0
else
    echo "[?] Unexpected response — manual review required"
    echo "Response snippet: $(echo "${RESPONSE}" | head -c 500)"
    echo "UNKNOWN"
    exit 2
fi