DaystoPatch

Check PointExploited incident

Check Point Management Server pre-auth path traversal and file upload (exploited since July)

CVE-2026-93616Critical, CVSS 9.8In CISA's Known Exploited Vulnerabilities catalog since 22 Sep 2026

  • Exploited before a fix
FixedFixed for every supported version on the day it became public.
Embed this live clock

Response

Silence
0h
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    CVE record CVE-2026-93616 (CNA: Check Point)CuratedQuote verified

    "assignerShortName":"checkpoint","dateReserved":"2026-09-18T11:08:38.818Z","datePublished":"2026-09-22T12:59:01.057Z"

    Check Point says exploitation happened on 2026-07-23, but nothing public was found before its own disclosure on 2026-09-22.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:95deeefdeb1cbc38…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    CISA KEV (CVE-2026-93616)ClaimedQuote verified22 Sep 2026

    Check Point Multiple Products Path Traversal Vulnerability

    Added to CISA's KEV catalog on 2026-09-22.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    The Hacker NewsCuratedQuote verified22 Sep 2026

    Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the company said.

    Article dated 'Sep 22, 2026'.

    Source
    The Hacker News news
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5d4bca52123d2bcd…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-93616ClaimedQuote verified22 Sep 2026, 12:59 UTC

    A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:95deeefdeb1cbc38…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet22 Sep 2026, 13:30 UTC

    CVE-2026-93616 (CRITICAL): Path traversal in Check Point Quantum Security Management allows unauthenticated script uploads & execution. Restrict access, monitor uploads. Patch

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet22 Sep 2026, 13:58 UTC

    A critical exploited Check Point Management vulnerability (CVE-2026-93616) allows attackers to execute arbitrary scripts. Secure your servers now. # CheckPoint # CVE202693616 # Cybersecurity # InfoSec # Vulnerability # RCE https:// securityonline.info/exploited-

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    at disclosure

    CVE record CVE-2026-93616 (CNA: Check Point)CuratedQuote verified

    "datePublished":"2026-09-22T12:59:01.057Z"

    The advisory sk1000171 carries its content only inside a page script (__NEXT_DATA__), so it cannot be quoted as visible text; the CVE record that Check Point published as CNA is used instead.

    Recorded time
    Precision
    To the minute
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:95deeefdeb1cbc38…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    date onlysame day

    SecurityWeekCuratedQuote verified

    As a mitigation option, customers are advised to limit access to the Management Server behind a security gateway or a firewall and limit access to port TCP/19009 to trusted IP addresses.

    Article dated September 23, 2026 (2:14 AM ET) and says Check Point announced the patches 'on Tuesday' (2026-09-22). The same 'Mitigation' section is in sk1000171's embedded data.

    Source
    SecurityWeek news
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:69861116e6acb185…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date onlysame day

    The Hacker NewsCuratedQuote verified

    Check Point released a fix on September 22 for the server that controls firewall policies for the Check Point gateways it manages.

    Fixes: R82.20 Security Hotfix and Jumbo Hotfix Accumulator R82.10 Take 45, R82 Take 127, R81.20 Take 170, R81.10 Take 192 (SecurityWeek).

    Source
    The Hacker News news
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:5d4bca52123d2bcd…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    SecurityWeekCuratedQuote verified

    To resolve CVE-2026-93616, Check Point released the R82.20 Security Hotfix (TAR) and also included the fixes in the Jumbo Hotfix Accumulator for R82.10 (Take 45), R82 (Take 127), R81.20 (Take 170), and R81.10 (Take 192).

    All supported versions (R82.20, R82.10, R82, R81.20) plus end-of-support R81.10 had fixes on the disclosure day. R81 and R80.x are end of support with no fix, not counted.

    Source
    SecurityWeek news
    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:69861116e6acb185…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

Check Point management servers hit by a zero-day file upload flaw, fixed Sep 22

Attackers used an unknown flaw in Check Point's firewall management server in July, two months before Check Point released hotfixes on 22 September 2026.

In plain words

The server that manages our Check Point firewalls had a critical flaw that attackers were using as early as July 2026. Check Point disclosed it and released fixes on 22 September 2026. If we run our own Check Point management server, we need the hotfix installed, access to it restricted, and the server checked for signs of an intrusion.

What happened and who is affected

What happened

On 22 September 2026 Check Point disclosed CVE-2026-93616, a path traversal and file upload flaw in the Management Server web service that lets an unauthenticated attacker upload and run scripts. Check Point said a handful of customers had been attacked, with targeted attacks observed on 23 July 2026. Hotfixes were released the same day as the disclosure.

Who is affected

Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent on R82.20, R82.10 (JHF Take 44 or lower), R82 (Take 126 or lower), R81.20 (Take 166 or lower), R81.10 (Take 190 or lower) and end-of-support R81/R80.x. Smart-1 Cloud and gateways are not affected.

CVE-2026-93616. Reviewed 23 Oct 2026. https://daystopatch.com/incidents/check-point-cve-2026-93616/

Affected products

  • Security Management Server
  • Multi-Domain Security Management Server
  • Log Server
  • Multi-Domain Log Server
  • SmartEvent
How we built this timeline

sk1000171 renders client-side; its text (including 'This vulnerability is exploited in the Wild. Check Point is aware of a handful of customers who have been attacked.', affected takes and the Mitigation section) is only in the page's __NEXT_DATA__ JSON, which a visible-text verifier cannot see, so vendor facts are cited from the CVE record and news (The Hacker News, SecurityWeek, Help Net Security).

The 23 Jul 2026 exploitation date comes from Check Point via The Hacker News and Help Net Security. Not related to CVE-2026-85102 (gateway VPN flaw, separate advisory sk1000117, fixed 9 Sep 2026), although both were added to KEV the same day; kept as separate incidents.

A different management server flaw, CVE-2026-91843, was fixed by LivePatch on 16 Sep 2026 (not in KEV).

Related

Check Point report card