Check Point Warns of Management Server Zero-Day Exploited in Targeted Attacks
Summary: Check Point said attackers exploited a previously unknown path traversal flaw, CVE-2026-93616, in its Security Management Server in a handful of targeted attacks on July 23, allowing anyone who can reach the server's web service to upload and run scripts without logging in. Check Point released a fix on September 22 and rated the flaw 9.8 out of 10 on CVSS, while separately reporting that attempts to exploit a VPN flaw, CVE-2026-85102, against Spark firewall customers have been underway since September 12.
Key Takeaway: The management server controls firewall policies for every gateway it manages, and Check Point's advisory does not name the July targets or say what attackers did after getting in - so a 9.8 unauthenticated flaw on the console that writes your firewall rules is the exposure to sit with.