Pre-auth path traversal to script execution in Check Point Security Management web service (CVE-2026-93616)
Check Point published fixes on 2026-09-22 after Check Point Research identified a handful of targeted exploitations of this zero-day, and CISA added it to KEV with a 2026-09-25 due date, so management servers left at older Jumbo Hotfix takes remain open to unauthenticated takeover.
A path traversal flaw in the Check Point Management web service lets an unauthenticated attacker who can reach the service execute a script from an arbitrary path and load an arbitrary Java class, giving code execution on the Security Management Server, Multi-Domain Server, Log Server, Multi-Domain Log Server or SmartEvent. Compromise of the management server exposes the policy and credentials for every gateway it manages.
Affected: Quantum Security Management R82.20 with no Jumbo Hotfix; Quantum Security Management R82.10 with Jumbo Hotfix Take 44 or below; Quantum Security Management R82 with Jumbo Hotfix Take 126 or below; Quantum Security Management R81.20 with Jumbo Hotfix Take 166 or below; Quantum Security Management R81.10 (EOS) with Jumbo Hotfix Take 190 or below; Quantum Security Management R81, R80.40, R80.30, R80.20, R80.10 (all EOS); Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, SmartEvent on the same versions
How to Test
Check the installed release and Jumbo Hotfix take on each Security Management, Multi-Domain, Log Server and SmartEvent host: R82.20 without any Jumbo Hotfix, R82.10 at Take 44 or below, R82 at Take 126 or below, R81.20 at Take 166 or below, R81.10 at Take 190 or below, and all R81/R80.x releases are vulnerable. Review the management web service's access logs for path traversal sequences and requests loading unexpected scripts or Java classes, look for unfamiliar script or class files on the server, and audit administrator accounts and policy changes; Check Point reports exploitation dating back to July 23, so widen the log window accordingly.
How to Mitigate
Install the Jumbo Hotfix that includes the fix per Check Point sk1000171: a take above 44 on R82.10, above 126 on R82, above 166 on R81.20, above 190 on R81.10, and the first available Jumbo Hotfix on R82.20. Hosts on R81, R80.40, R80.30, R80.20 or R80.10 are end-of-support and must be upgraded to a supported release; until fixed, restrict access to the management web service to trusted administrative networks.