How to Check and Patch Check Point CVE-2026-93616

Check Point disclosed CVE-2026-93616 on September 22, 2026, after finding that attackers had already used the flaw against Security Management systems. The vulnerability is a pre-authentication path traversal and file-upload issue that can let an unauthenticated attacker execute scripts and load Java classes on an affected Management Server. This guide shows how to identify vulnerable versions, apply the correct Jumbo Hotfix, restrict management access while patching, and check whether the server may already have been targeted.

Why CVE-2026-93616 needs a version check first

CVE-2026-93616 affects the Check Point Management web service rather than being simply a firewall packet-processing bug. Check Point rates the vulnerability 9.8 under CVSS 3.1, with network access required but no authentication or user interaction. The underlying problem is directory traversal combined with file upload, which can allow an attacker to reach an unintended filesystem location and execute an uploaded script. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 22, confirming that exploitation is not merely theoretical.

Check Point says it observed a handful of targeted attacks on July 23, 2026. The company describes the exploitation as pinpointed rather than reporting a broad automated campaign, but that distinction does not remove the need to investigate an exposed Management Server. A successful attack can affect the system that stores and distributes firewall policy, so administrators should treat a potentially compromised Management Server separately from the question of whether the managed gateways themselves are forwarding traffic normally.

Find out whether your Management Server is affected

First identify the Check Point release and Jumbo Hotfix Accumulator, or JHF, installed on the Management Server. A JHF is Check Point's cumulative package of fixes for a particular software release, so the release number alone is not enough to establish whether this vulnerability is fixed. The affected versions include R82.20 without the required security hotfix, R82.10 through Take 44, R82 through Take 126, R81.20 through Take 166, and R81.10 through Take 190. Older R81 and R80.x releases are also listed as affected and are end-of-support branches.

The fixed levels above come from Check Point's September 22 advisory and its published Jumbo Hotfix records. For example, R82 Take 127 and R82.10 Take 45 contain the CVE-2026-93616 fix, while the R81.20 branch received the fix in Take 170. The difference between the affected threshold and the fixed release matters because installing an intermediate Take that predates the security fix does not close the vulnerability.

Install the Jumbo Hotfix that contains the fix

Once you have identified the branch, install the corresponding security update using Check Point's supported upgrade process. R82.20 customers need the dedicated Security Hotfix, while R82.10, R82, R81.20 and R81.10 customers should move to the fixed Jumbo Hotfix level for their branch. Check Point's published release notes explicitly record CVE-2026-93616 as resolved in R82 Take 127, R82.10 Take 45, R81.20 Take 170 and R81.10 Take 192.

Do not treat a previous LivePatch as sufficient protection. Check Point specifically states that LivePatch Take 28/29 does not address CVE-2026-93616. After the installation, verify the active Management Server reports the expected release and JHF level rather than assuming that a successful installer run means the production service is now using the patched files.

Restrict Management Server access while you patch

If an immediate upgrade is not possible, reduce the attack surface while arranging the update. Check Point's guidance includes restricting access to the Management Server's TCP port 19009 so that it is reachable only from trusted addresses. The purpose is straightforward: an unauthenticated vulnerability is much harder to exploit when the vulnerable management service is not exposed to untrusted networks.

This should be treated as a temporary risk-reduction measure rather than a replacement for the security fix. Check Point's advisory provides additional mitigation and hardening guidance for affected deployments, and the exact network arrangement matters because Management Servers, Log Servers and Multi-Domain environments can have different dependencies. After restricting access, verify that legitimate SmartConsole and management functions still reach the required service from the approved administration networks.

Check for signs of exploitation before declaring the incident closed

Check Point recommends using the detection and hunting instructions in its security advisory when investigating potentially compromised systems. Preserve relevant logs before making extensive changes, then review activity around the affected service for unexpected requests, files, processes or management changes. The July 23 exploitation activity reported by Check Point means that an affected system should not be considered clean simply because no obvious problem appeared after the patch was installed.

Pay particular attention to evidence that would indicate activity beyond the initial web request. An attacker who obtained script execution on a Management Server may have attempted to establish persistence, collect credentials or alter management data. The investigation should therefore include the Management Server itself and the administrative activity associated with it, rather than looking only for failed firewall connections.

Verify the patched state after the restart

After installing the update, check the running Management Server again and confirm that it is on the fixed Take or security hotfix for its branch. This second check catches a practical problem that is easy to miss during emergency patching: administrators sometimes update one node while another active or standby Management Server remains on the vulnerable release. In environments with multiple management components, verify each affected system rather than checking only the primary console.

Also confirm that the management service is reachable only through the intended administrative paths. The security fix addresses the vulnerable code, while restricted management access reduces exposure to future management-service vulnerabilities. These are separate controls, and keeping both in place makes the next emergency update less dependent on how quickly an administrator can reach every internet-facing system.

What to do with older Check Point releases

Older R80 and R81 releases listed as affected are a separate maintenance problem because they are end-of-support branches. If one of these systems is still operating, the remediation path should be confirmed with Check Point rather than assuming that a newer Jumbo Hotfix can simply be installed over the old release. Moving to a supported software branch may be necessary, and that can require planning beyond the immediate CVE response.

The key distinction is between fixing the vulnerability and returning the platform to a maintainable security state. A Management Server on an end-of-support release may require a larger upgrade project, but leaving an internet-reachable affected system unchanged because the migration is inconvenient leaves the vulnerable service exposed. Until the supported upgrade path is completed, the management interface should be kept behind appropriate access controls and monitored for suspicious activity.

The next check is whether the server was exposed when attacks were happening

CVE-2026-93616 was disclosed on September 22 with evidence of exploitation dating to July 23. That timeline gives administrators a concrete period to examine when reviewing potentially exposed systems. If your Management Server was running an affected configuration during that period, compare its logs and administrative changes against known maintenance activity and investigate anomalies before treating the patch as the end of the incident.

For an unaffected or already-patched system, the practical maintenance task is simpler: record the current release and Take, keep Management Server access restricted to trusted administration paths, and continue monitoring Check Point's security advisories. For an affected system, the order is more important: restrict exposure, install the appropriate fix, verify every relevant management component, and then investigate historical activity. That sequence closes the vulnerability while leaving enough evidence to determine whether the server was already touched.