CVE-2026-93616 is a path traversal vulnerability in Check Point Security Management Server and related products that allows unauthenticated attackers to upload and execute arbitrary scripts. This flaw enables low-complexity attacks that can compromise the management infrastructure of enterprise networks. Check Point has issued emergency hotfixes in the R82.20 Security Hotfix release to remediate this vulnerability. The vendor also provides temporary mitigations such as firewall placement and IP-based access restrictions via SmartConsole. The vulnerability is confirmed to be exploited in the wild, with a limited number of customers affected. This issue is part of a series of recent critical vulnerabilities in Check Point products, some of which have been exploited by ransomware groups and other threat actors.

Successful exploitation allows unauthenticated attackers to upload and execute arbitrary scripts on Check Point Management Servers, potentially compromising security policy management, administrative controls, and log collection across enterprise networks. This could lead to unauthorized control over critical security infrastructure components. The vulnerability is actively exploited in the wild, indicating real-world impact and risk to affected organizations.

Check Point has released an official security hotfix (R82.20 Security Hotfix) that addresses this vulnerability. Customers are strongly advised to apply this hotfix immediately. For those unable to patch immediately, Check Point recommends placing vulnerable systems behind firewalls and restricting access to trusted IP addresses using the Trusted Clients settings in SmartConsole. Security teams should also monitor for indicators of compromise shared in the vendor advisory. These mitigations are temporary and do not replace applying the official patch.