--- title: Check Point warns of Management Server zero-day... description: Check Point Software issued emergency hotfixes for a critical path traversal zero-day (CVE-2026-93616) in its Security Management Server, Multi-Domain Security... canonical: https://daily.dev/posts/check-point-warns-of-management-server-zero-day-exploited-in-attacks-1gw6pyzal twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Check Point warns of Management Server zero-day exploited in attacks | daily.dev og:description: Check Point Software issued emergency hotfixes for a critical path traversal zero-day (CVE-2026-93616) in its Security Management Server, Multi-Domain Security... og:url: https://daily.dev/posts/check-point-warns-of-management-server-zero-day-exploited-in-attacks-1gw6pyzal og:image: https://api.daily.dev/og/posts/1GW6PyZAL.png og:image:alt: Check Point warns of Management Server zero-day exploited in attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Check Point warns of Management Server zero-day exploited in attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Check Point Software issued emergency hotfixes for a critical path traversal zero-day (CVE-2026-93616) in its Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent products. The unauthenticated flaw lets attackers upload and execute arbitrary scripts and is being actively exploited against a handful of customers. Check Point released the R82.20 Security Hotfix and shared indicators of compromise, along with temporary mitigations like restricting access to trusted IPs. This follows a string of other actively exploited Check Point vulnerabilities in recent months, including authentication bypass flaws linked to Qilin ransomware and a root-privilege login bypass. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-93616 in Check Point Security Management Server? CVE-2026-93616 is a critical path traversal vulnerability in Check Point Security Management Server that lets unauthenticated attackers upload and execute arbitrary scripts through low-complexity attacks. It affects Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Check Point confirmed active exploitation against a handful of customers and released the R82.20 Security Hotfix as a fix. _Teams patching Check Point infrastructure can track fast-moving CVE disclosures like this on daily.dev._ ### How can I mitigate CVE-2026-93616 if I can't immediately apply the Check Point hotfix? Restrict access to Security Management Server by placing it behind a firewall and limiting connections to trusted IP addresses, configured under Manage & Settings > Permissions & Administrators > Trusted Clients in the SmartConsole dashboard. Check Point also published hardening guidance and indicators of compromise so security teams can check for evidence of prior exploitation before the R82.20 Security Hotfix is deployed. _Security teams weighing interim mitigations against a full patch can follow developments like this on daily.dev._ ### What other Check Point vulnerabilities have been actively exploited recently? Besides CVE-2026-93616, Check Point has disclosed several actively exploited flaws: CVE-2024-24919 in Quantum Security Gateways tied to NailaoLocker ransomware, an authentication bypass (CVE-2026-50751) exploited by a Qilin ransomware affiliate since June, and another auth bypass (CVE-2026-16232) exploited since at least July to gain administrator access to SmartConsole panels via root-privilege code execution. _Anyone tracking Check Point's exploited-vulnerability pattern can follow the ongoing advisories on daily.dev._ ## Similar posts on daily.dev - [New Check Point flaw lets hackers execute code with root privileges](https://daily.dev/posts/new-check-point-flaw-lets-hackers-execute-code-with-root-privileges-wi9m2bohy) · BleepingComputer · 0 upvotes · 0 comments - [Check Point SmartConsole Authentication Bypass Is Under Active Attack, and a PoC Is Now Public](https://daily.dev/posts/check-point-smartconsole-authentication-bypass-is-under-active-attack-and-a-poc-is-now-public-gygbdb6p9) · Latest Hacking News · 0 upvotes · 0 comments - [One Port to Root: Weaponizing Check Point Management CVE-2026-93616](https://daily.dev/posts/one-port-to-root-weaponizing-check-point-management-cve-2026-93616-foy8qulzb) · Sliver C2 Documentation · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/check-point-warns-of-management-server-zero-day-exploited-in-attacks-1gw6pyzal) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Check Point warns of Management Server zero-day exploited in attacks","url":"https://daily.dev/posts/check-point-warns-of-management-server-zero-day-exploited-in-attacks-1gw6pyzal","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/check-point-warns-of-management-server-zero-day-exploited-in-attacks-1gw6pyzal"},"datePublished":"2026-09-22T16:37:04.643Z","dateModified":"2026-09-24T02:30:09.737Z","description":"Check Point Software issued emergency hotfixes for a critical path traversal zero-day (CVE-2026-93616) in its Security Management Server, Multi-Domain Security...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/aa779db3094cfe399d2cb442f5b15862?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/aa779db3094cfe399d2cb442f5b15862?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/check-point-warns-of-management-server-zero-day-exploited-in-attacks-1gw6pyzal","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,zero-day","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Check Point warns of Management Server zero-day exploited in attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/check-point-warns-of-management-server-zero-day-exploited-in-attacks-1gw6pyzal#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-93616 in Check Point Security Management Server?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-93616 is a critical path traversal vulnerability in Check Point Security Management Server that lets unauthenticated attackers upload and execute arbitrary scripts through low-complexity attacks. It affects Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent. Check Point confirmed active exploitation against a handful of customers and released the R82.20 Security Hotfix as a fix. Teams patching Check Point infrastructure can track fast-moving CVE disclosures like this on daily.dev."}},{"@type":"Question","name":"How can I mitigate CVE-2026-93616 if I can't immediately apply the Check Point hotfix?","acceptedAnswer":{"@type":"Answer","text":"Restrict access to Security Management Server by placing it behind a firewall and limiting connections to trusted IP addresses, configured under Manage \u0026 Settings \u003e Permissions \u0026 Administrators \u003e Trusted Clients in the SmartConsole dashboard. Check Point also published hardening guidance and indicators of compromise so security teams can check for evidence of prior exploitation before the R82.20 Security Hotfix is deployed. Security teams weighing interim mitigations against a full patch can follow developments like this on daily.dev."}},{"@type":"Question","name":"What other Check Point vulnerabilities have been actively exploited recently?","acceptedAnswer":{"@type":"Answer","text":"Besides CVE-2026-93616, Check Point has disclosed several actively exploited flaws: CVE-2024-24919 in Quantum Security Gateways tied to NailaoLocker ransomware, an authentication bypass (CVE-2026-50751) exploited by a Qilin ransomware affiliate since June, and another auth bypass (CVE-2026-16232) exploited since at least July to gain administrator access to SmartConsole panels via root-privilege code execution. Anyone tracking Check Point's exploited-vulnerability pattern can follow the ongoing advisories on daily.dev."}}]} ```