CVE-2026-93616: Directory Traversal and File upload allows execution of arbitrary script on the Management Server

• • A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on the Check Point Management Server.
    This vulnerability is exploited in the Wild. Check Point is aware of a handful of customers who have been attacked.

  • This issue received the ID CVE-2026-93616 and a CVSS score of 9.8.

  • Affected Products: Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, SmartEvent.
    

  • Not Affected Products: Smart-1 Cloud (fix is already applied), Check Point Firewall Appliances, Check Point Spark Firewall.

  • Affected Versions: 
    • R82.20
    • R82.10 Jumbo Hotfix Take 44 or lower
    • R82 Jumbo Hotfix Take 126 or lower
    • R81.20 Jumbo Hotfix Take 166 or lower
    • R81.10 Jumbo Hotfix Take 190 or lower (EoS)
    • R80, R80.10, R80.20, R80.30, R80.40, R81 (all EoS)
    Note: Check Point LivePatch Take 28/29 does not address this issue.
    
    

  Mitigation

  Limit access to your Management Servers behind a Security Gateway/Check Point Firewall according to the Check Point Gateway and Management Hardening Administration Guide.

  • Make sure that access to port TCP/19009 is only possible from Trusted IP addresses.

  • If you already have a Security Gateway / Check Point Firewall with implied rules enabled, make sure your Trusted Clients are limited to trusted internal IP addresses. This will create an Implied rule limiting access.
    To do so:
    1. In SmartConsole, go to Manage & Settings > Permissions & Administrators > Trusted Clients.
    2. Double-click the client you want to edit.
    3. In the Trusted Client configuration window that opens, change the settings as needed.
       
    4. Click OK.

    

  
  

  Indication of Compromise

  Check for these two indicators of compromise on every Security Management, Multi-Domain Security Management, Log, Multi-Domain Log, and SmartEvent Server:

  1. Run this command from Expert mode:

     grep -nHP "login\(loginRequest=LoginRequest\{authenticationInfo=AuthenticationInfoBase\{username='[^' ]{1001,}'" "$MDS_FWDIR"/log/cpm.elg*

     Output Example:

     /opt/CPsuite-R82/fw1/log/cpm.elg.13:653:17/09/26 17:30:03,562 INFO coresvc.internal.LoginSvcImpl [qtp1491953039-6857]: login(loginRequest=LoginRequest{authenticationInfo=AuthenticationInfoBase{username='abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdababcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcd'}, connectionMode=READ_WRITE, applicationName='SmartConsole', userAgent='null', actionOnOtherClientSession=NO_ACTION, workSessionId='null', workSessionMode=USE_EXISTING, workSessionType=PRIVATE, keepAliveTimeout=0, getDomainList=true, domain=null, domainName='null', domainIp='10.x.x.x', remoteIpAddr='null', VersionDetails=VersionDetails{majorVersion='R82', minorVersion='R82', officialName='R82', smartConsoleBuild='null'}})

     If the above command returns an output, check if there is an FWM/MDS core dump file that was generated at the same time. Run: 

     ls -l /var/log/dump/usermode/ | grep -e fwm -e mds

     If a core dump file was generated at the same time as the login attempt returned by the first command, there has been a potential attempt to exploit this vulnerability in your environment.

  2. Run this command from Expert mode:
     grep -E "ERROR.*upgrade\.base\.ReflectionUtils.*Failed to load allResourceFiles map from" $MDS_FWDIR/log/cpm.elg*
     
     If this command returns an output, this means that there has been a potential attempt to exploit this CVE in your environment.
     Review the output for suspicious file paths containing directory traversal sequences (for example, ../).
     
     Output Example:
     18/09/26 21:54:57,396 ERROR upgrade.base.ReflectionUtils [qtp700085606-66\]: Failed to load allResourceFiles map from /opt/CPupgrade-tools-../../../../tmp/003193_VULNCHECK/scripts/upgrade_files.conf
     
     In this example, the path contains a directory traversal sequence (../../../../), which may indicate an attempt to exploit the vulnerability.

This problem was fixed. 

• Download the R82.20 Security Hotfix (TAR)

The fix is also included in:

• Jumbo Hotfix Accumulator for R82.10 starting from Take 45
• Jumbo Hotfix Accumulator for R82 starting from Take 127
• Jumbo Hotfix Accumulator for R81.20 starting from Take 170
• Jumbo Hotfix Accumulator for R81.10 starting from Take 192

Notes:

• These Jumbo Hotfix Accumulators also include the fix for CVE-2026-91843 (sk1000155).
• Because of the nature of the fix, a LivePatch is not be available for this issue.