Cybersecurity
Check Point patches Management Server flaw under attack
Check Point Software issued emergency hotfixes for a critical Security Management Server flaw, said it was being exploited, and gave temporary mitigations for customers unable to patch at once.
- Check Point Software released emergency hotfixes for a critical vulnerability in its Security Management Server line.
- The flaw, tracked as CVE-2026-93616, was a path traversal issue that could let unauthenticated attackers upload scripts and run them on vulnerable servers.
- Check Point said the issue was being exploited and that it knew of a small number of customers who had been attacked.
- The company said R82.20 Security Hotfix covered Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent, and it provided temporary mitigations.
Check Point Software issued emergency hotfixes after finding a critical flaw in its Security Management Server line. It said the issue let unauthenticated attackers upload scripts to vulnerable management servers and run them.
The company said it knew of a small number of customers who had been attacked and told security teams to look for signs of compromise using indicators in its advisory. It also offered temporary mitigations for systems that could not be patched straight away.
Check Point said R82.20 Security Hotfix fixed the problem and that the affected set included Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server and SmartEvent. For interim protection, it recommended isolating systems behind a firewall and restricting access to trusted IP addresses through SmartConsole.
The article also noted that CISA and the FBI had been urging software makers since May 2024 to remove path traversal flaws before release. It said Check Point had recently dealt with other vulnerabilities that were reported as actively exploited, but those were separate issues.
Named in this story
Companies
- Check Point Software
- released the hotfixes and warned customers about the flaw
Governments and agencies
- Cybersecurity and Infrastructure Security Agency
- urged software companies to remove path traversal weaknesses before release
- FBI
- joined the advice to software companies on path traversal weaknesses
Products and systems
- Security Management Server
- the affected central management system
- R82.20 Security Hotfix
- the update that Check Point said fixed the issue
- Multi-Domain Security Management Server
- listed by Check Point as affected
- Log Server
- listed by Check Point as affected
- Multi-Domain Log Server
- listed by Check Point as affected
- SmartEvent
- listed by Check Point as affected
- SmartConsole
- the dashboard used in the temporary access restrictions
How the source tells it
The article used a standard incident-alert register, with urgency driven by emergency patching and alarm from claimed active exploitation.
- urgency emergency hotfixes and repeated instructions to patch or apply temporary mitigations
- alarm the claim that the flaw was being used against customers and allowed script upload by unauthenticated attackers