Attackers are exploiting a 9.8 Check Point management flaw that lacks a final patch for every release
CISA added CVE-2026-93616, a 9.8-rated Check Point management flaw, to its Known Exploited Vulnerabilities catalog on September 22, 2026. A dev.to write-up says no final patch covers every release yet, so port exposure is the control.
The Engineer · Build desk
Key figures: the flaw is rated 9.8, Critical, under CVSS v3. Interfaces reachable on TCP port 19009 are the population that matters, the write-up says. ZoomEye lists 1,068,268 instances matching a Check Point query and zero matching the CVE; neither count shows that population.
| Figure | Value | Note | Claim |
|---|---|---|---|
| CVSS v3 score of the path traversal flaw, Critical | 9.8 CVSS v3 score | 1 | |
| TCP port whose reachable interfaces are what matters | 19,009 TCP port | per the dev.to write-up | 16 |
| Instances matching app="Check Point", per ZoomEye | 1,068,268 instances | zero match the CVE identifier | 15 |
What happened
- Check Point has confirmed attacks against a small number of customers.
- Exploitation needs TCP port 19009 reachable from an untrusted network and an affected build, and it needs no credentials.
- Affected products cover the standard and Multi-Domain editions of both the Security Management Server and the Log Server, plus SmartEvent.
- Affected builds include R82.20 with no Jumbo Hotfix, R82.10 at Take 44 or below, R82 at Take 126 or below and R81.20 at Take 166 or below.
- ZoomEye lists 1,068,268 instances matching a Check Point product query and zero matching the CVE identifier.
Why it matters
- exposure A compromised management server lets the attacker alter policy, read configuration and reach managed devices over the trusted channel. On log components the same access exposes the records defenders use to investigate.
- decision Release and hotfix take together decide whether a build is affected, and two of the six listed entries are end of support. Those operators have the least room to wait for a patch.
- precedent The write-up treats this as a recurring placement problem for management interfaces. In our view the same external-reachability probe is worth running against every other management plane in the estate.
The exploit path has no login step to watch. The traversal weakness lets an uploaded file escape the directory meant to contain it, and the server then executes the result [5]. CISA's description says the affected products "contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts" [4]. The reported sequence is a direct connection followed by a crafted upload [7]. Because authentication is not required, the dev.to write-up says authentication auditing alone is unlikely to surface an attempt [20].
Patching is not yet a complete answer. LivePatch Take 28 and Take 29 do not resolve the flaw, and no final patch covered all affected releases when the write-up was reported [17]. Its mitigation advice is about reachability: put the management interface behind a security gateway and limit TCP port 19009 to trusted IP addresses. It also points to Check Point advisory SK1000171 for release-specific fix status [18]. That status is as of the write-up, so the advisory is where to check whether any release line has since been fixed.
The write-up's validation test is cheap. From an external vantage point, confirm that no management or log server interface answers on port 19009. Then review management server logs for unexpected uploads or script execution [19]. In our view the external check goes first: it takes one probe per server, and a failing result has a firewall-rule fix.
Scanner counts will not size the exposure. The write-up says the zero CVE-level result reflects indexing coverage and does not mean the risk is absent. It adds that the population that matters, interfaces reachable on port 19009, cannot be inferred from either figure [16]. A scanner index returning zero for a CVE is a statement about the index. For the product-level count to transfer to your estate, the index would have to have probed port 19009 on your addresses, and the write-up does not say that it did.
Scoping depends on the build. Smart-1 Cloud and Check Point Firewall Appliances are reported as unaffected [13]. Older end-of-support releases from R80 through R81 are also reported as vulnerable [12]. A public proof-of-concept has not been confirmed, according to the write-up. It says the confirmed exploitation is the fact that should drive prioritization [8].
What to watch
- Check Point advisory SK1000171 listing a final fix for every affected release line, and LivePatch takes beyond 29.
- A public proof-of-concept appearing, since none is confirmed today.
- Scanner indexes such as ZoomEye adding CVE-level fingerprints for CVE-2026-93616.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+5
- Incentives
- Insufficient
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CVE-2026-93616 is a path traversal vulnerability (CWE-22) in Check Point management and logging products, rated 9.8 (Critical) under CVSS v3.
- [2]
CISA added CVE-2026-93616 to the Known Exploited Vulnerabilities catalog on September 22, 2026, citing evidence of active exploitation.
- [3]
Check Point has confirmed attacks against a small number of customers.
- [4]
CISA's description states that the affected products "contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts."
- [5]
The traversal weakness lets an uploaded file escape the directory intended to contain it, and the server then executes the result.
- [6]
Exploitation requires TCP port 19009 to be reachable from an untrusted network and the target to run an affected build. No credentials are needed.
- [7]
The reported exploitation sequence is a direct connection followed by a crafted upload.
- [8]
A public proof-of-concept has not been confirmed. The write-up says the confirmed exploitation is the fact that should drive prioritization.
- [9]
Script execution on a management server places an attacker inside the control plane, where policy can be altered, configuration data read, and the trusted management channel used to reach managed devices. On logging and event components, the attacker gains access to the records used for detection and post-incident analysis.
- [10]
The affected products are Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent.
- [11]
Reported affected releases include R82.20 without a Jumbo Hotfix, R82.10 with Jumbo Hotfix Take 44 or below, R82 with Take 126 or below, R81.20 with Take 166 or below, R81.10 (end of support) with Take 190 or below, and R81 (end of support).
- [12]
Older end-of-support releases from R80 through R81 are also reported as vulnerable.
- [13]
Smart-1 Cloud and Check Point Firewall Appliances are reported as unaffected.
- [14]
The affected set is defined by both release and hotfix take level, so administrators should confirm their exact build and hotfix take against the vendor advisory.
- [15]
ZoomEye reports 1,068,268 instances matching app="Check Point" and zero matching vul.cve="CVE-2026-93616".
- [16]
The write-up says the zero CVE-level result reflects indexing coverage rather than an absence of risk, and that the population that matters, interfaces reachable on TCP port 19009, cannot be inferred from either aggregate figure.
- [17]
No final patch covering all affected releases was available at the time of reporting, and LivePatch Take 28 and Take 29 do not resolve the flaw.
- [18]
Mitigation advice: restrict management server access so the interface sits behind a security gateway, limit TCP port 19009 to trusted IP addresses, and consult the official Check Point advisory (SK1000171) for release-specific fix status.
- [19]
Validation should confirm from an external vantage point that no management or log server interface answers on port 19009, and should include a review of management server logs for unexpected uploads or script execution.
- [20]
Because authentication is not required for exploitation, authentication auditing alone is unlikely to surface an attempt.
- [21]
Two of the six release entries listed in c11 are labelled end of support (R81.10 and R81).
- [22]
The write-up calls the vulnerability a case study in a recurring architectural problem: management interfaces never designed to face the public internet, placed where the public internet can reach them.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toCVE-2026-93616 and the Risk of Exposing Check Point Management Interfaces
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Path TraversalFollow
- Known Exploited Vulnerabilities catalogFollow
- Network management securityFollow