Check Point Management Server exploited in the wild (CVE-2026-93616) [PoC]

Actively exploited in the wild - CVE-2026-93616 is a critical directory traversal and file upload vulnerability in Check Point Management Server that grants unauthenticated attackers remote script execution on the management host. CISA added it to the Known Exploited Vulnerabilities catalog; apply the vendor hotfix immediately.

Overview

CVE-2026-93616 is a directory traversal paired with an unrestricted file upload in Check Point Management Server, the central console used to configure and monitor Check Point Security Gateways. Because the vulnerable endpoint performs no authentication check and no path sanitization, an attacker who can reach the management interface over the network can write files outside the intended upload directory.

By placing a script in a web-accessible location, the attacker converts the upload into code execution under the web server’s privileges. No credentials, no user interaction, and no special network position are required beyond reachability to the management port. That combination is why the CVSS score is 9.8: network attack vector, low complexity, no privileges, no user interaction.

Impact

Check Point Management Server is a high-value target. It stores security policies, gateway credentials, and often site-to-site VPN secrets, and it holds trusted relationships with every managed gateway. Arbitrary script execution there gives an attacker a pivot into the entire security estate: they can read configuration databases, push or weaken policy, harvest credentials for managed devices, and use the management server as a foothold for lateral movement into protected networks.

Because the exploit is unauthenticated and remotely reachable, internet-exposed management interfaces are at immediate risk. Management servers should never face the public internet, but historically many are found on internet scan data, and attackers are clearly scanning for this one.

Remediation

• Apply the vendor hotfix for CVE-2026-93616 as the first priority. Check Point published the fix in its advisory; confirm your version and install the appropriate build.
• Until you patch, restrict access to the management interface: block it at the perimeter, allow only jump hosts or VPN ranges, and audit firewall rules for any exposure to 0.0.0.0/0.
• Assume compromise if your server was internet-exposed. Rotate credentials for managed gateways, API keys, and administrator accounts, and review logs for unexpected file writes or new web-accessible scripts.
• Monitor the management server’s web root and upload directories for files that do not belong there.

Threat actors actively monetize management-plane access, so treat any confirmed exploitation as a potential data breach. Breach reports are tracked at breach reports, and follow-up coverage appears under security news.

Security Insight

Check Point’s management plane has become a recurring target precisely because it concentrates trust: compromise the console and you inherit control of every gateway it manages. This echo of the 2021 Check Point zero-day campaign shows attackers have learned that the console, not the firewall, is the softest path into an enterprise’s perimeter. Vendors that ship unauthenticated upload endpoints on administrative interfaces are handing attackers a permanent, reusable entry primitive, and with CVE-2026-93616 already in KEV, defenders should assume scanning began before the patch was published.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs