Check Point CVE-2026-93616: the console was the target

Two weeks ago the Check Point story was the VPN gateway. This week it is the box that manages the gateway, and that one has been exploited since July. On September 22, Check Point disclosed CVE-2026-93616 — a CVSS 9.8 pre-authentication path traversal in Security Management. Same day, CISA added it to the Known Exploited Vulnerabilities catalog. If you patched your gateways in September and closed the ticket, reopen it.

What actually happened

CVE-2026-93616 lives in the Check Point management web service. An unauthenticated attacker can traverse out of the intended path, execute a script from an arbitrary location, and load an arbitrary Java class. Pre-auth means no credentials, no session, nothing to phish first.

The timeline is the part worth sitting with. Check Point says it observed "a handful of pinpointed attacks" on July 23, 2026. The advisory and the fix landed September 22, 2026. Do that subtraction yourself.

Affected versions are broad: R82.20, R82.10 Jumbo Hotfix Take 44 or lower, R82 Take 126 or lower, R81.20 Take 166 or lower, R81.10 Take 190 or lower, and the entire R80 line — R80, R80.10, R80.20, R80.30, R80.40 and R81 — all of which are past end of support. Remediation steps and indicators of compromise are in Check Point support article SK1000171.

The same advisory updates CVE-2026-85102, the certificate-validation flaw in Security Gateway we wrote about on September 13. The fix shipped September 9. Exploitation against Spark customers globally began September 12. The three-day window we said was coming was actually three days.

CISA put both CVEs into KEV on September 22 under BOD 26-04, alongside Arista VeloCloud Orchestrator (CVE-2026-93952) and F5 BIG-IP APM (CVE-2026-94127).

Why your firewall console matters more than your firewall

Most small businesses treat the management server as furniture. It sits on an internal VLAN, somebody set it up four years ago, and it gets patched when the gateway does — which is to say, sometimes.

The management plane is a higher-value target than the data plane. Owning a gateway gets an attacker one gateway. Owning the management server gets them policy authoring across every gateway it manages, plus the logs that would have shown you what happened. It is the difference between a stolen key and the ability to cut new ones.

"It's internal" is not a control. Pre-auth RCE on an internal service is still pre-auth RCE the moment anything on that network is compromised — a laptop, a printer, a contractor VPN session. Management interfaces should be on a separate segment with an explicit allowlist of who can reach them, and almost nobody we audit has that.

End-of-support versions are the real finding. If you are on R80.20, there is no hotfix coming. That is not a patching task, it is a migration project, and it should have started before you read this sentence.

Two months of exploitation means assume, then verify. A fix closes the door. It does not tell you whether anyone walked through it in July. Pull SK1000171, run the indicators against your logs, and check admin accounts and policy change history for anything you cannot account for.

The uncomfortable pattern across September: F5, Arista, Check Point twice. Edge and management appliances are where the exploitation is, and they are exactly the boxes that do not show up in anyone's patch dashboard because nobody installed an agent on them.

Sources: Check Point, CISA.