CVE-2026-93616 is a critical zero-day vulnerability in Check Point's Management Server and related products, characterized by a directory traversal and file upload flaw that enables unauthenticated attackers to upload and execute arbitrary scripts. The vulnerability has been exploited in the wild, with confirmed attacks on some customers. Check Point released the R82.20 Security Hotfix and included fixes in Jumbo Hotfix Accumulators for versions R82.10 (Take 45), R82 (Take 127), R81.20 (Take 170), and R81.10 (Take 192). Standard LivePatch updates do not mitigate this vulnerability. Recommended mitigations include network access restrictions to the Management Server and limiting TCP port 19009 access to trusted IP addresses. The US CISA agency has added this vulnerability to its KEV catalog, mandating rapid patching for federal agencies.

The vulnerability allows unauthenticated remote attackers to upload and execute arbitrary scripts on Check Point Management Server products, potentially leading to full compromise of the affected servers. Exploitation has been observed in the wild, indicating active threat. This could result in unauthorized control over management infrastructure, impacting security monitoring and control capabilities.

Check Point has released official patches and hotfixes for CVE-2026-93616 across multiple product versions. Customers should apply the R82.20 Security Hotfix or the appropriate Jumbo Hotfix Accumulator for their version immediately. Standard LivePatch updates do not resolve this issue. As a temporary mitigation, restrict Management Server access behind a security gateway or firewall and limit access to TCP port 19009 to trusted IP addresses only. Follow Check Point's advisory and CISA guidance for detailed remediation steps.