Check Point has confirmed that a critical vulnerability in its Management Server software was actively exploited by attackers before a patch was available, turning one of the most trusted components in many enterprise security stacks into an open door. The flaw, tracked as CVE-2026-93616, carries a CVSS score of 9.8 and requires no authentication to exploit.

A path-traversal bug with an outsized blast radius

At the heart of the issue is a directory traversal weakness combined with unsafe file handling in the Management Server’s web service. By manipulating file paths sent to the server, an attacker can trick it into executing a script from a location of their choosing and loading an arbitrary Java class, all without ever logging in. In practice, that means a remote, unauthenticated attacker who can reach the exposed service can upload and run their own code directly on the server.

That server is not a peripheral system. Check Point’s Management Server, along with the related Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent, is the console that defines firewall rules, security policy, and event correlation across an organization’s Check Point deployment. Gaining code execution there effectively hands an intruder the keys to how an environment is defended.

Exploited before the fix shipped

Check Point says it identified exploitation of the flaw on July 23, 2026, before an official patch was released, meeting the definition of a true zero-day. The company has characterized the activity it observed as “limited and pinpointed,” language that suggests a targeted campaign rather than mass exploitation, though it has not disclosed who was behind the attacks, what they were after, or which organizations were affected.

The scope of vulnerable software is broad. Affected builds include Security Management Server and Multi-Domain Security Management Server running R82.20, R82.10 through Jumbo Hotfix Take 44, R82 through Take 126, R81.20 through Take 166, R81.10 through Take 190, and every version in the R80 line. Cloud-hosted Smart-1 Cloud instances, along with Check Point’s firewall appliances and Spark Firewall product line, are not affected.

What defenders should hunt for

Because exploitation predates the patch, organizations running affected versions need to assume compromise is possible rather than simply patching and moving on. Check Point has published specific indicators to search for, including:

• Unusually long usernames appearing in the cpm.elg log file
• ReflectionUtils errors referencing a failed “allResourceFiles map” load
• Returned file paths that contain directory traversal sequences such as ../

Crucially, Check Point is advising customers to check every management server for these signs, not just internet-facing ones, since the exposure isn’t limited to systems deliberately opened to the public web.

Patches and mitigation steps

Fixes are now available: R82.20 Security Hotfix, R82.10 Take 45, R82 Take 127, R81.20 Take 170, and R81.10 Take 192 or later all remediate the flaw. Notably, Check Point has clarified that the existing LivePatch Takes 28 and 29 do not fix this issue, and no LivePatch-based remediation is planned, so administrators relying on LivePatch will need to apply the full hotfix or Jumbo Hotfix Accumulator instead.

Beyond patching, Check Point recommends a defense-in-depth approach for any management server that cannot be updated immediately:

• Place management servers behind a Security Gateway or Check Point firewall rather than exposing them directly
• Restrict access to TCP port 19009 to a short list of trusted IP addresses
• Limit the Trusted Clients setting in SmartConsole to known internal hosts
• Preserve logs and core dumps if suspicious activity turns up, and isolate affected servers where operations allow

Organizations that find evidence of compromise are being directed to contact Check Point Support directly rather than remediate on their own, since a compromised management server may need forensic handling to fully understand what an attacker accessed or changed.

Why this matters beyond Check Point customers

Security management platforms are an increasingly attractive target precisely because they sit above the systems they protect. A single unauthenticated bug in this class of software can undo the value of every policy it manages, and the fact that this one was actively exploited before disclosure underscores why vendors and defenders alike are placing growing emphasis on monitoring the management plane, not just the assets it oversees. Enterprises running any of the affected builds should treat patching as urgent, and should not assume that a lack of internet exposure rules out risk.