Check Point on Tuesday announced urgent patches for a critical-severity vulnerability in the Management Server that was exploited in the wild as a zero-day vulnerability.
The vulnerability, tracked as CVE-2026-93616 (CVSS score 9.8), is described as a directory traversal and file upload issue that could allow unauthenticated attackers to upload and execute arbitrary scripts on the management server.
“This vulnerability is being exploited in the wild. Check Point is aware of a handful of customers who have been attacked,” the cybersecurity firm warned in its report advisory.
According to Check Point, the bug affects the Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent products.
To address CVE-2026-93616, Check Point released the R82.20 Security Hotfix (TAR) and also included the fixes in the Jumbo Hotfix Accumulator for R82.10 (Take 45), R82 (Take 127), R81.20 (Take 170), and R81.10 (Take 192).
As a workaround, customers are recommended to restrict access to the management server behind a security gateway or firewall and limit access to port TCP/19009 to trusted IP addresses. Check Point found that standard LivePatch updates do not resolve CVE-2026-93616.
Check Point has also published Indicators of Compromise (IoCs) to help companies identify potential exploiters.
On Tuesday, the US cybersecurity agency CISA added the zero-day bug to its catalog of known exploited vulnerabilities (KEV) along with CVE-2026-85102 (CVSS score of 9.8), a security flaw in Check Point’s Security Gateway and Spark Firewall products that was fixed on September 9.
CVE-2026-85102 is described as improper validation of certificate data during VPN negotiation and could allow remote, unauthenticated attackers to bypass authentication and execute arbitrary code on the security gateway.
“Check Point disclosed the vulnerability and released fixes on September 9, 2026. At that time, we had no evidence of exploitation. We are now monitoring exploitation attempts against Check Point Spark customers worldwide. Customers who have not yet installed the fix should do so immediately.” Check Point said in a separate guide.
According to the requirements of BOD 26-04, federal authorities had three days to fix both vulnerabilities after they were added to it KEV catalog.
Related: Nightmare Eclipse drops new Microsoft Defender exploit after identity leak
Related: Current security vulnerability in the ZyXEL switch exploited by Chinese hackers
Related: WordPress fixes the “Click2Shell” vulnerability
Related: Organizations are being warned about three exploited vulnerabilities in the Linux kernel
