Check Point Software has released emergency hotfixes to address a critical Check Point zero-day vulnerability in its Security Management Server that could allow unauthenticated attackers to upload and execute arbitrary scripts on vulnerable systems. The flaw, tracked as CVE-2026-93616, is a path traversal issue that the company says is already being exploited in the wild against a small number of customers.
What the Check Point Zero-Day Vulnerability Exposes
The Security Management Server is a central repository that stores and manages security policies, processes administrator changes, and collects system logs across enterprise networks. The Check Point zero-day vulnerability allows threat actors to bypass authentication entirely and upload malicious scripts with low complexity. Check Point has confirmed that the flaw affects Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent products.
“This vulnerability is exploited in the wild. Check Point is aware of a handful of customers who have been attacked,” the company warned in its advisory. The company has addressed the issue in R82.20 Security Hotfix and urges security teams to check their networks for evidence of successful exploitation using the indicators of compromise provided in the security advisory.
Immediate Actions and Temporary Mitigations
For organizations unable to deploy the hotfix immediately, Check Point provides temporary mitigation measures, including placing vulnerable systems behind a firewall and limiting access to trusted IP addresses through Manage & Settings > Permissions & Administrators > Trusted Clients in the SmartConsole dashboard.
This incident reflects a broader pattern of security challenges facing the company. As covered earlier, CISA Warns of Critical Gitea Vulnerability Exploited in Code Injection Attacks highlighted similar urgency around critical flaws. Additionally, NovaCookies Phishing Toolkit Exploits DocuSign to Hijack Microsoft 365 Sessions demonstrated how attackers continue to target enterprise infrastructure through multiple vectors. In recent months, Check Point has warned of multiple actively exploited flaws, including authentication bypasses in SmartConsole admin panels and critical VPN vulnerabilities flagged by the Dutch National Cyber Security Centre (NCSC-NL) for urgent patching. The Cybersecurity and Infrastructure Security Agency (CISA) and the FBI have long urged software companies to eliminate path traversal weaknesses before release, calling such issues “unforgivable” since at least 2007.
المصدر: BleepingComputer
